If you're running a WordPress site, now would be a good time to ensure you are using very strong passwords and to make sure your username is not "admin." According to reports from HostGator and CloudFlare, there is currently a significant attack being launched at WordPress blogs across the Internet. For the most part, this is a brute-force dictionary-based attack that aim to find the password for the 'admin' account that every WordPress site sets up by default.
HostGator's analysis found that this is a well-organized and very distributed attack. The company believes that about 90,000 IP addresses are currently involved. CloudFlare, its founder and CEO Matthew Prince told me earlier today, thinks the hackers control about 100,000 bots. As for the scope of the attack, Prince says that CloudFlare saw attacks on virtually every WordPress site on its network.
If somebody guesses your WordPress password, that's obviously a big problem, but attacks like this then open up ways for the hackers to take over your server – and that's what whoever is behind this attack is clearly after. The CloudFlare team believes that the attacker is currently using a network of relatively low-powered home PCs, but the aim is "to build a much larger botnet of beefy servers in preparation for a future attack." Home PCs can be the staging ground for a large denial-of-service attack, but servers have access to far more bandwidth and can hence push out far larger amounts of traffic.
This currently attack is similar to an attack in 2012 that was also aimed at WordPress sites. That attack, however, was looking for outdated versions of TimThumb, a popular PHP-based image resizer that is often used as the default by many WordPress templates.
Both CloudFlare and HostGator, as well as a number of other hosting providers, have taken measures to protect their customers. Besides choosing a very strong password – which is always a good idea – you can also install a number of WordPress plugins that limit the number of login attempts from the same IP address or network to put a stop to these brute-force attacks (though as WordPress founder Matt Mullenweg notes in a blog post this afternoon, changing your 'admin' username to something ab it more obscure may be your best defense given that the hackers do have 90,000 IPs at their disposal). If your site is hosted on WordPress.com, you can also turn on two-factor authentication to add an extra layer of security.
WordPress, which is commonly used to refer to all WordPress products, is the most popular and fastest growing publishing platform on the web. WordPress began as a blogging platform but soon evolved to include additional types of websites including news sites, corporate sites (for large brands and small businesses alike), ecommerce sites and everything in between. Known as the Content Management System (CMS) of the Web, WordPress products (WordPress.org, WordPress.com and WordPress.com VIP) currently power 1 in 2 blogs...
CloudFlare is a service that does one thing: make websites better. With a single change to DNS, sites are instantly protected from a wide range of online threats, see an increase in page load speeds, and have their content dynamically optimized across the Internet. CloudFlare's core service is free.
HostGator.com is a world leading provider of shared, reseller, and dedicated web hosting services. Privately held and based in Houston, Texas, the company was founded in 2002 by current President and CEO Brent Oxley, who started the company from his dorm room at Florida Atlantic University. Since then, HostGator has grown from a small hosting company with just three servers into a world leading and industry recognized hosting provider with more than 7,000 servers under management. In 2008, HostGator...
No hay comentarios:
Publicar un comentario