11 {{ upvoteCount | shortNum }}
11 {{ upvoteCount | shortNum }}

Has Anyone Seen Any Increase In WP Hijacking Attempts?

by azmanar
9 replies
Hi,

Has anyone seen any increase in hijacking attempts of their WP installations from St.Petersburg, Russia?

It seems this guy is using the typical Admin brute force password gen.

He doesn't even care to change his IP address even after 16 attempts in a span of 2 hours. This IP address is a static IP and not from an ISP user, therefore could be a bot script he started to use for selected sites.

I have checked that this IP range was blacklisted for spam in only 2 out of 75 spamhaus database. This is negligible, therefore has been reserved for quite a while and had just been released.

The owner of this full IP range is from Lublin, Poland for a dedicated server he placed in St.Peterburg, Russia. I have yet to decide whether to pursue this matter further. Waiting for another wave of attempts in 24 hours.

So, please be aware, just in case it is the start of a new wave of hijacking attempts to weak WP installations.

My advice is never use username Admin for your WP admin role because this would always be the INITIAL ATTEMPT. Use some other usernames. This would be your first line of defence against hijacking attempts.

The next attempt would be SQL injection to see PHP and SQL error. Therefore, do not use WP as the prefix for your database tables. Use something else and obscure.

This WF blog could be useful for a start-up knowledge in protecting your WP installations.

Have a nice weekend.
#attempts #hijacking #increase
  • Profile picture of the author Deepak Media
    Just have an ultra strong password like this and brute force becomes useless...

    E=y:?;W}y3R(rs'+,b%b~LHo

    And of course you can't type it in every time. Use password management softwares and make sure to use 2-pass obfuscation (half auto type and half from clipboard) to get the password entered in the field.
    Signature
    Digital Marketing Author | Speaker | Consultant

    Read my Blog: DigitalDeepak.com

    @ Bangalore, India.
    {{ DiscussionBoard.errors[6356058].message }}
    • Profile picture of the author so11
      Originally Posted by Deepak Media View Post

      Just have an ultra strong password like this and brute force becomes useless...

      E=y:?;W}y3R(rs'+,b%b~LHo

      And of course you can't type it in every time. Use password management softwares and make sure to use 2-pass obfuscation (half auto type and half from clipboard) to get the password entered in the field.
      Hello,

      it is a good practice, but creating another single point of failure/security breach. Without a proper backup, you are cooked if things go wrong...because its just virtually impossible to remember such passwords for many login pages.
      Signature
      www.groupesoloviev.com
      We help businesses manage cyber risk and compliance requirements.
      {{ DiscussionBoard.errors[6404668].message }}
  • Profile picture of the author imfusa
    It is also recommended to add a captcha on login, this should stop any hacker.
    Signature
    internet marketing | seo services | check pagerank | web directory
    {{ DiscussionBoard.errors[6356127].message }}
    • Profile picture of the author Tropic
      Originally Posted by imfusa View Post

      It is also recommended to add a captcha on login, this should stop any hacker.
      is the captcha login a plugin or is there a way to choose that option in settings?

      actually just checked, how do you change your WP username? - I see you can change your password but not user
      Signature
      head for the tropics!
      {{ DiscussionBoard.errors[6357987].message }}
      • Profile picture of the author sbucciarel
        Banned
        Originally Posted by Tropic View Post

        is the captcha login a plugin or is there a way to choose that option in settings?

        actually just checked, how do you change your WP username? - I see you can change your password but not user
        You can change your username in the database via phpMyadmin. Click on the wp_user table and you can change it that way.
        {{ DiscussionBoard.errors[6358013].message }}
  • Profile picture of the author sbucciarel
    Banned
    I use Limit Login Attempts plugin on my sites and I get someone attempting to use brute force to log in daily.

    Limit Login Attempts | devel.kostdoktorn.se

    This takes care of that problem
    {{ DiscussionBoard.errors[6356261].message }}
  • Profile picture of the author azmanar
    Originally Posted by Tropic View Post

    actually just checked, how do you change your WP username? - I see you can change your password but not user
    Originally Posted by Chris Kent View Post

    But when you end up with 30+ WP installations its just a nightmare to manage the security.
    Hi,

    In the WF blog I mentioned in the OP, I have suggested a plugin to change the username Admin easily without touching PHPMyAdmin. The same plugin will help you to change your WP table prefixes and hide your WP version.

    And the plugin provider also offers you an online security dashboard at their location, where you can manage scores of WP sites from 1 simple interface. There are other providers, but this is simply user-friendly and inexpensive.
    Signature
    === >>> Tomorrow Should Be Better Than Today
    {{ DiscussionBoard.errors[6358493].message }}
  • Profile picture of the author so11
    Hello,

    Disabling your default admin account is considered a very good security practice.

    By limiting your login attempts you can actually lock yourself out as well (so its succeeded DOS attack).
    Depending on your host, try limiting your http requests and actuals connections from same IP. If number is reached, lock out IP for some time.

    Azmanar, there is just no way, an experienced guy would use a Static IP address to do this. The address is probably spoofed or its a bot computer/server that is infected and attacking you. Try to filter this IP adress and see what happens.
    Signature
    www.groupesoloviev.com
    We help businesses manage cyber risk and compliance requirements.
    {{ DiscussionBoard.errors[6404577].message }}

Trending Topics