How To Stop A WordPress Dictionary Attack

You guys! Lest we forget, Your Joe Dog was under attack!

Apparently there’s a widespread dictionary attack that uses tens of thousands of malwared computers to attack WordPress sites. Your Joe Dog uses WordPress as a CMS. Your Joe Dog was attacked!

The extent of the attack was not initially clear. I was alerted by sluggish performance. I noticed a lot of POSTs to wp-login.php. Those POSTs appeared in the access log like this:

92.47.65.37 - - [17/Jun/2013:09:06:42 -0400] "POST /wp-login.php HTTP/1.0" 
200 3444 "-" "Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/2010 Firefox/19.0"

I have a script that allows me to quickly block IP addresses with iptables. So I started harvesting addresses and blocking them. Done and done.

Except the attacker seemed to have an endless supply of IP addresses. The attack persisted no matter how many addresses I blocked.

Take a look at the log entry above. The referer field is empty. A Joe Dog Fellow suggested I block all POSTs that don’t include a referer. Afterall, you don’t POST out of the blue – you submit a form in your browser. I blocked those types of requests with a simple mod_rewrite rule:

 RewriteCond %{REQUEST_METHOD} =POST
 RewriteCond %{HTTP_REFERER} ^-?$
 RewriteRule ^/(wp-login.php|wp-admin) - [F,NS,L]

Done and done. Amiright? Sadly, no….

Continue reading »

Posted in Security, Wordpress | 5 Comments



Your Joe Dog Is Under Attack

Wanted: Kevin MitnickThis site has been under attack for several weeks now. The attacker is using an unthrottled brute force dictionary attack. He seems to have an unlimited supply of IP addresses. After examining some of the source addresses, I’ve concluded that we’re on the wrong end of a bot net.

I’ve been harvesting IP addresses and blocking them as fast as I can. I’ve also added Rewrite rules to deny these attempts based on his request signature. Those rules reduce overhead since his requests won’t generate database transactions. Yet no matter how many timeouts he gets and no matter how many Access Denied responses he endures, the attacks persist.

Because this dictionary attack is unthrottled, the affect is, at times, not unlike a DOS attack. Your Joe Dog is a public service with shallow pockets. We simply don’t have the resources to eat these attacks and provide you with snappy service. Bare with us as we deal with this asshole.

UPDATE: While it provides additional inconvenience, I applied an access control to the page he’s attacking. You can protect a single file inside a FilesMatch block like this:

 <FilesMatch "wp-login.php">
   AuthType Basic
   AuthName "Kiss my fscking ass"
   AuthUserFile /path/to/my/file
   Require user franklindelanoroosevelt
 </FilesMatch>

Obviously, some of that information was obfuscated but “Kiss my fscking ass” really is the realm I’m using.

The benefit to this approach is two-fold: 1. Apache doesn’t expend much effort to say, “401 gimme a password!” 2. If this layer is cracked, he still has to bust the next one before I reset the password on the first one….

 

Posted in Security, Wordpress | 1 Comment



Digging His Grave

“He’s digging his own grave with a very large spade.”

– Kevin Egan, an extradition attorney, on the revelation that Edward Snowden divulged NSA hacking activity inside China.

Posted in Security | Leave a comment



Mountains of NSA Data

Get SmartLast week the Guardian broke the news about Prism, an NSA data mining project in which the security agency harvests transaction records with the cooperation of private telecoms and internet companies. While it’s illegal to eavesdrop without a warrant, the NSA is harvesting conversational meta-data: calling records, email transactions and credit card swipes. This is basically the stuff you’d find in server logs.

The news was greeted with simultaneous outrage and indifference. Some were tremendously bothered by the news while others shrugged and said “meh.” Your Joe Dog’s congressman emailed to say he was greatly bothered by the news. Really? Then why didn’t you email constituents after any one of the thirteen briefings you had on the subject?

Five years ago, the NSA was probably incapable of doing much with all the data it collected. Just managing its information would have been a full time job. Since it began its surveillance programs, the NSA has brought up a series of large data centers to warehouse its records. The biggest, its Death Star, was constructed at Camp Williams, Utah.

The agency also improved its ability to effectively use this information. As the New York Times reports, NSA is working with Silicon Valley big data experts to efficiently sift through its transaction records. Its algorithms search for patterns and alert human agents when they match the hallmarks of terrorist activity.

And this is where it gets eerie.

From a study published in Nature, we learn that just four points of phone data are necessary to pinpoint the caller’s location with 95% accuracy. The average person leaves many breadcrumbs that reveal his whereabouts: cell phone data, EZ-Pass transactions, credit card purchases, ATM transactions, etc. Using information from cell towers, the agency can pinpoint your altitude right to the floor you’re sitting on at this moment. (I’ll save you some trouble: I’m currently on the third).

If you’d prefer to keep your location a secret, then, yes, this program is a concern. Unfortunately, it appears to be perfectly legal. You can have modern conveniences like cell phones, EZ-Pass, credit and debit cards or privacy. Pick one.

 

 

Posted in Security | Leave a comment



The Chinese Military Is Hacking US Infrastructure

chicoms

The New York Times reports that a large percentage of Chinese cyber attacks on American targets originate from inside a same small neighborhood that features a Chinese army headquarters building. The headquarters, a large white office tower in Shanghai, is surrounded by restaurants, massage parlors and a wine importer. It is the only structure in the neighborhood capable of housing a large number of sophisticated cyber attackers. This all but confirms the Chinese army is behind the American attacks.

The hackers, known in the US as the Comment Crew, were traced to Shanghai by Mandiant, a US security firm hired by the NY Times. The New York paper hired Mandiant to end infiltration of its network last year. The Virginia firm traced that attack and hundreds like it to the Shanghai neighborhood that houses the base, known as P.L.A. Unit 61398.

The firm were not able to confirm the attacks originated inside the building but the probability is very high.

“Either they are coming from inside Unit 61398,” said Kevin Mandia, the founder and chief executive of Mandiant, in an interview last week, “or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.”

Sure, it’s possible that an enterprise scale hacking effort led by mainland Chinese with direct access to Shanghai telecom infrastructure has setup shop inside one of the restaurants by Unit 61398. Now that they’ve been exposed we’ll just wait for the Chinese government to shut them down. That should happen any minute now. Yep … any … minute … now. Who are we kidding? The Chinese are attacking us!!

Posted in Security | Leave a comment



The Security Two-Step

This is depressing.

Matt Honan is an author at Wired. Recently his Google account was comprimised. And since his online life was chained together, the hackers were soon able to access his Twitter, Amazon, AppleID, iPhone, iPad and MacBook accounts. For lulz, they erased his digital life.

By his own admission, Honan was sloppy. His accounts were interconnected and his data was not backed up. His biggest regret was that he didn’t take the time to implement a defense mechanism provided by Google. He didn’t set up 2-step verification. In the article, Honan refers to it as “two-factor authentication.”

What’s two-step verification? This is a system provided by Google which adds an extra level of security to your account. After it’s set up, you’ll need two things for access. You’ll need to provide something you remember (your password) with something you have (a code on your phone).

Learn how to set up 2-step verification after the jump.

Continue reading »

Posted in Security | Leave a comment