WordPress Hacking Prevention

Thanks Phil - even better

Thanks Phil,

Very useful indeed.

Andy

James, while I agree that many of these so-called 'security' and audit plugins may do little to harden an installation, I doubt that security through obscurity is an effective countermeasure either.

I will stick my neck out and hazard a guess that most blog break-ins on up-to-date software are the result of brute-force password attacks, where the attacker simply keeps rapidly trying variations of common passwords and random combinations.

A powerful defense against this common attack is:

1) Use a good password - i.e not a word from the dictionary, and bonus points for including upper and lower case, numbers and punctuation.

2) Don't transmit the password in clear text - use a plugin that will encrypt the password on the client before passing it to the server, such as Chap Secure Login

3) Temporarily lock out an IP address that appears to be trying lots of failed passwords i.e looks like an attack: Login LockDown

If you have those covered, an attacker will most likely move on to easier pickings.

I'm not saying just using a plugin is going to stop all attacks. If someone wants to get you they probably will.

My ozemedia.com forum got un-repairably corrupted a few years ago by a persistent attacker (maybe attackers) who kept at it for months until all my time was being spent fixing problems and I eventually closed it.

And it's the same with blogs. If someone with the skills wants to make things bad for you, they will.

However, at least if you're taking some preventative measures like adding a security plugin, and making coding changes, you're doing more than 99.9 percent (guess) of other blog owners, so you should be safe from drive-by attacks.

phil

I think that is about right since 100% of all my sites I have coded in Php ...lol

James

Ahhhh, I just noticed you are selling a Wordpress "security" product in your sig. That explains a lot.

I was having a great laugh reading your parody "security" site before realizing you are actually trying to be serious.

From the sales page:

Priceless! Rather a sweeping statement there don't you think?

Wow that's amazing! Hardening WordPress explains how to prevent some of them by changing the database table prefix, but I can see you are well ahead of the core development team on this one.

Really? So instead of of just making them read-only (chmod 755) and invisible (Options -Indexes in .htaccess) we can actually "block" them from "hackers" (whatever that means). This is great news.


Just think of all the time myself and countless others have wasted keeping WP blogs up to date with the latest official security patches, when all along we could have just bought a "secure" system for the cheap one-off price of $39.97.


Even the WordPress Firewall Plugin mentioned above states "Its purpose is not to replace prompt and responsible upgrading", but I see your apparently impervious product requires no such disclaimer.


Infosec and digital forensic skills are in high demand by Fortune 500s, have you considered consulting? Maybe you already are, or perhaps scaring blog owners into spending $39.97 is more lucrative?


On the topic of credentials, "15 years of Internet industry experience" sounds way too modest for such groundbreaking achievements in computer security. Don't be shy, tell us how you did it. I am sure there are heaps of web-monkeys out there looking to make the leap into the lucrative world of digital forensics.

Except yours, right?

Is "dealing with" a euphemism for "misleading"?

A very revealing statement, as one of the hallmarks of unconscious incompetence is the inability to recognize a deficit.

In my opinion, claiming that Open Source software is inherently insecure because it isn't obscure indicates an overall lack of understanding of the causes of software vulnerabilities.

Whether software is open or closed source is largely irrelevant. It's security is dependent primarily on the quality of the code.

There are numerous Open Source cryptographic and other security oriented software in widespread use with very few issues. On the other hand there are also very popular closed source operating systems that regularly announces patches for newly discovered vulnerabilities.

Some people may consider it disturbing when a "secure" software vendor appears to have little grasp of the subject. The tragedy is that their customers are most likely unaware of this, and in their search for some peace of mind, put their faith in the snake oil.

From my experience working in software industry and also my training company providing security certification like the CISSP, CEH and the Security+ I think that xiaophil has some very valid points here.

Good security points for your wordpress blog in my opinion are:

- Dont have username "admin"
- Set your server to deny access to IP and log attempt after so many wrong logins, this will help you defend against brute force. Setting your server up to send a SMS to your phone when alarm is triggered is something we have done for mission critical system before.
- Change the prefix of the wordpress database.
- Dont use shared hosting. In most of the cases my clients have been hacked it is usually because they are on shared hosting. We have kept their site secure but another site that shares the same server is vulnerable and allowed access. Shared hosting means your website shares a server with literally thousands of other websites.

Underground hacker and bot networks can do a lot of damage with 0day exploits before they are patched. Making your self "hacker proof" in most cases is not practical, but making sure you are not an easy target is essential, and usually enough to keep you out of trouble.

Usually though the entry point for hacks are keyloggers distributed through P2P or bit-torreent sites. The hacker takes out your weak home system and then gains access passwords to all your accounts. This happens more than you could believe and the fall out of something like this can be nasty. Virus scanners are not real security, they just stop the noobs that dont know how to make viruses themselves.

Siteblaster,

Thanks for your response.

I certainly have no beef with the legitimate security auditing industry.

What does get my heckles up is seeing self-proclaimed experts preying on the uneducated, and the sure signs of a charlatan are broad, sweeping generalizations linked to cure-all claims and the conspicuous lack of credentials.

That may not be happening here, but the warning signs are evident.

As I am not positioning myself as a security expert, my credentials are perhaps not as important as someone who is.

"Computer security" is a huge and varied business, what aspect of it were you involved in specifically?

And seeing as you are the one with the hands-on experience, could you explain how specifically did you validate the claims of the product in question?

After all, as a professional security auditor, surely you didn't just base your conclusions on whether the vendor sounds like they know what they are talking about, did you?

I am always receptive to new ideas, as well as corrections and feedback from a domain expert. Unfortunately you have provided nothing more here than some kind of vague warning and a lot of finger waving.

I'll write that down for future reference.

Well then, respectfully, perhaps you could contribute to this thread by actually sharing some of your knowledge instead of just telling us how big it is.

Your tone is not all that sincere, but my endeavors are doing fine, thanks.

Like I said, If you are willing to explain things, I am happy to listen, but this attitude of "I know lots and you're wrong, and what do you know anyway" just doesn't cut it I'm afraid.

Not difficult at all, easy peasy. All you need to do is install them and activate them and you're good. There are some options available for each, but I've found the default settings to be just fine.

There is only one way to completely stop any chance of being hacked...

Unplug the computer running the blog form the internet

Other than that...I don't care if it is open source or a custom designed application...someone good wants in...their getting in...period...