Business Blogging Pros

Why Would Hackers Pick On My Site?

When I talk to bloggers and website owners about the important of security, I'm often asked:

"Why would hackers picking on my obscure little blog?"

Your blog or website is not specifically being targeted.  The attacker is using a bot (software program) that is simply fed a list of domain names to check. The bot's goal is to look for specific vulnerabilities.  When a vulnerability is found, the attacker does one of four things:

Defacement - You wake up one morning and discover that your website as been replaced by one advocating 'Free the Armenian Freedom Fighters' or something akin to the adjacent image.

Viagra - This one is so frequent and well known it has its own name: Pharma Hack. Your website is altered so that to a normal visitor it looks just fine.  To Google however it looks like a page of links to an online Viagra store.

Remote Control -The attacker installs malicious code on your site that puts it under the attacker's control, adding your site to the attacker's botnet. Large-scale distributed denial of service (DDoS) attacks almost always employ such botnets

Remote Control Installer - This one is even more insidious.  The attacker installs malicious code on your site that causes your website visitors' computers to be infected and become part of the attacker's botnet.

What Should I Do?

Every website owners should be doing three things:

Implement Security

We recommend two solutions:

• Sucuri.net
• Wordfence

There are differences in functions, features, and price between Sucuri and Wordfence but these are the two products I use to secure my sites and those of my clients.

Keep WordPress and Plugins Up To Date

I can't stress this enough.  For example, Just yesterday I received notification that a Cross-Site Scripting Vulnerability has been discovered in one of the plugins I frequently use.  I've now updated all those site.  The best thing you can do to keep your site protected is to keep WordPress and your plugins up to date.

Strong Passwords and Non-Obvious Usernames

Do you use 'admin' as the username to log in to your website?  You might as well put a big bullseye on your home page.  Use something obscure. Look at your profile page in WordPress and verify that your nickname and display name are different from your username. Use WordPress' New Password function to let WordPress pick a really strong password for you.

A Plug For Our Services

We have a high-end service available to high-profile clients with high-visibility mission-critical websites. It is expensive but but if you absolutely positively cannot afford to be hacked then you should contact us.

WordPress Brute-Force Attackers Keep Getting Smarter

A brute-force attack is one in which the attacker tries to guess your login credentials.  These attacks are almost always automated.  Not long ago I woke up one morning to see that there had been ten thousand brute-force attacks against just one of my blogs overnight.

Traditionally, brute-force attacks are easily detectable. Most security-related plugins can detect and log every login attempt. Several security-related plugins can even be configured to block the IP address of an attacker after a certain number of failed attempts.

In the past few weeks however, a new tactic relying upon WordPress' XML-RPC function has surfaced. The new attack is highly efficient and allows the attacker to try hundreds of password in a single request. The details of this attack can be found in a blog post written by Sucuri.net:

Securi.net Blog Post

Time to Adjust Our Tactics

My personal opinion is that for a piece of software with as big a bullseye on it as WordPress, XML-RPC should be a big No-No. Older versions of Wordpress contained a setting that allowed you to turn XML-RPC off, but no more.

This problem is exacerbated by the fact that the most popular WordPress security plugin (Wordfence) no longer has the ability to disable XML-RPC.  

UPDATE: Wordfence has published a blog post in which they say they DO protect against these attacks.

If you are using Sucucri.net's Cloud Proxy Firewall then don't worry - You are protected against these attacks.

If however you are using Wordfence or some other security plugin that cannot disable XML-RPC then you should install one of the WordPress plugins designed specifically for this purpose.  we are using Disable-XML-RPC.

The Downside

Unfortunately, disabling XML-RPC can break things:

• WordPress.com's JetPack plugin using XML-RPC
• iPhone/iPad/Android apps for posting to your blog use XML-RPC

I'm sure there are other applications that use WordPress' XML-RPC facility as well.  Frankly, I believe this problem is sufficiently serious that I recommend turning off XML-RPC anyway and stop using these XML-RPC-dependent apps and plugins.

 

 

How's Your WordPress Password Strength?

I woke up this morning to an alert from Wordfence that one of the administrators of a client's website logged in overnight from Istanbul Turkey.  I know for a fact this particular gentleman is not in Istanbul right now.

How did this happen? A weak, easily guessable password.

There has been a dramatic increase in these Brute-Force attacks in the past few weeks. I logged 2500 of these attacks on just one of my websites in just one day.  Almost all the IP addresses are from eastern bloc countries.

What To Do:

1. If you have not updated to the latest version of WordPress do so now. Version 4.3 and later have a new 'Change Password' function that can create strong passwords.

2. If you are not using WordFence or Sucuri.net do so now.  The premium version of Wordfence has the ability to block entire countries, so if you have no reason to expect website visitors from outside the USA then block all non-US traffic.

Wordpress: Author Profile Hacking

I saw this while examining the Wordfence 404 log on a client's site this morning:

Those URLs with ?author=[number] is the hacker trying to learn the usernames of the website's authors. Once the username is know then the hacker can concentrate on figuring out the password.

It's best to block the hacker's IP address because when this approach fails he'll just move on to the next attack.  In many cases I'll block the hcker's entire network.

 

Watch Those 404s

One of the tactics that hackers use is to fish for vulnerabilities.  For example, you may see this in your logs:

https://mydomain.com/wp-content/plugins/gravityforms/css/formsmain.css

You may see that and say, "I don't have GravityForms installed." There is a known vulnerability in older versions of GravityForms that can be used by hackers to install malware.  Seeing that in your log means that a hacker is checking to see if your website may have that vulnerability.

If you take note of the hacker's IP address and search the logs for other entries from the same IP address, the chances are good that you'll see other similar entries associated with other plugins with known vulnerabilities.  It's time to block that IP address.

Probably the most popular tool for performing these tasks is Wordfence, a free WordPress plugin with an inexpensive premium option that allows your copy to access a global database of known hacker IP addresses.

Wordfence automatically logs all 404 errors.  You can then examine the list and block the suspicious IP addresses.

404 errors: An Early Warning of a Hack Attempt

I was studying the logs from one of my WordPress websites the other day and it dawned on me that logging and tracking 404 (File Not Found) errors is one of the keys to preventing an attack.  For example, here is one of the URLs in the log:

http://www.businessbloggingpros.com/wp-admin/admin-ajax.php?action=getfile&/../../wp-config.php

There is a membership plugin named ‘Paid Memberships Pro’.  Older versions of it had a vulnerability that would allow the hacker to download the main configuration file (wp-config.php) from a website using this url.  The hacker was blindly try this on my website, hoping to get lucky.

What I saw in the log was the same IP address trying various URLs, hoping to find a know exploitable vulnerability.

I think you can see that it is important to implement a mechanism to detect these sorts of probes and then lockout the offending IP address.  There are several plugins that do this, one of the best known is Wordfence. 

None of thee solutions is a panacea: hackers keep getting smarter and their methods keep evolving, so it is important to keep up-to-date regarding wordpress security developments.  One of the best ways to do that is to follow the better known blogs on WordPress security, such as:

http://blog.sucuri.net

http://www.wordfence.com/blog/

 

Why I Don't Link Jetpack

Jetpack is a wonderful Press plugin offered by WordPress.com.  It provides a lot of features but has one big fault:  It relies up XMLRPC.  

XMLRPC is a computer-to-computer communications method.  The WordPress iPhone app uses it to allow you to administer your WordPress website or blog remotely from your iPhone or iPad.  The big problems is that the XMLRPC code in WordPress is a big entry vector for hackers.

As a result, I recommend adding this code to the .htaccess file (located in the root folder of your website):

<files xmlrpc.php="">
Order Deny,Allow
Deny from all
</files>

Free WordPress Security Course

Free for the first ten people who send me an email at dbarnhart AT businessbloggingpros DOT com.  Include your first and last name and the subject "Free Wordpress Security Course".

A couple of days ago a hacker made 6544 brute-force login attempts against a client's website in 45 minutes. Fortunately our security suite was installed.  We not only saw the record of the attack, prevented it, we also had enough information to shut down his internet access.

Backstory:

We are heavy-duty custom wordpress developers. One of our recent clients is:

http://beckarnley.com

We've developed custom wordpress websites, blogs, and plugins for the entire range of companies from Inc500 companies to solopreneurs. As WordPress has gotten more popular as a website platform, it has attracted the attention of the hackers. Automated bots work there way across the internet looking for WordPress sites with known vulnerabilities. Just one bot can test 20,000 websites per day. And there are dozens of bots.

About 2 years ago we developed our Security Suite, a suite of best-practices for securing WordPress websites against most common hacking attempts.  Since then we've used it to protect our own sites as well as the sites of our clients. And after two years of operation under actual 'combat conditions', it's time to make it more widely available.

The course normally costs $59 and takes less than an hour to complete. It is comprised of a baker's dozen (13) short videos, each dealing with a specific topic and containing  screenshots and step by step instructions.

 

WordPress Security: Sucuri

Face it: Those of us using WordPress need to start paying more attention to security.  The days of 'set-and-forget' are long gone. WordPress has become the low-hanging fuit for hackers. Automated bots scour the internet looking for vulnerable WordPress websites.

I'm pretty impressed with Sucuri.net - enough so that we recommend them and have clients using their services.

Sucuri will scan your WordPress website periodically to see if any files have been changed, added, or deleted, looking for malware at the same time.

It also monitors login attempts and automatically locks out offending IP addresses after 5 attempts. One of the interesting things Sucuri does is to check these offending IP addresses against its global database.

Sucuri also offers a 'cleaning service' to remove most of the common malware infections.

Sucuri's services are pretty affordable ($99/yr for a single website). Considering the implications of waking of some morning to discover that malware in your website has been infecting your vistors' computer, that's pretty inexpensive

 

DIsclaimer: LInks to Sucuri.net in this article are affiliate links.

WordPress Security: Delete Those Unused Themes And Plugins

Short Version:

Delete unused themes and plugins from your WordPress website, particularly those that are automatically installed by WordPress.

Long Version:

Do you have a WordPress website? So so then go to your web browser and enter this (replace 'yourdomain.com' with your actual domain name):

http://www.yourdomain.com/wp-content/themes/twentyeleven

Chances are you will get an error message that begins with:

PHP Fatal error:  Call to undefined function  get_header() in ...

The '...' will be the full path to a file on your website. This is a security issue known as Full Path Disclosure. A hacker can use this information to hack your website by:

• Using it in combination with other vulnerabilites to steal configuration files.
• Engage in a brute-force attack on your web hosting control panel.

This is not just a theoretical vulnerability! 

The easy fix is to simply delete unused themes and plugins. For example, wordpress normally installs one or more themes into the theme directory ("Twenty Twelve', etc). If you are not using those themes then delete them.

For those clients paying us on a monthly or annual basis to manage their websites or blogs, we take a different approach: We create a honeypot.

We leave the unused theme folders in place ('twentyeleven', 'twentytwelve' etc).  We replace the existing index.php file with a new one that notifies us via email of the acccess attampt and reports the attacker's email address. It looks like this:

<?php 

$culprit = "An FPD attack was initiated from " . $_SERVER['REMOTE_ADDR'];

mail('youremail address','FPD ATTACK ATTEMPT',$culprit,'From: [email protected]');

?>

As a result we often receive these notifications and the attacker's IP address is usually somewhere in eastern Europe.

Keeping the Hackers Out

UPDATE: We now recommend Sucuri.net or Wordfence

While surfing the web yesterday, I read one company's story of how there WordPress website had been hacked.  Their description contained this:

"To our amazement, we discovered that a common line of malware code had been surreptitiously added to folders throughout our website: our header, our index page, every plug-in folder and our functions."

There is an easy way to prevent this. We do it for every WordPress blog and website we build: There is a free plugin: Wordpress File Monitor. Every 30 minutes (or whatever period you specify) it wakes up and calculates a cryptographic hash for every file on your website.  If anything changes it sends you an email.  It also detects when files have been added or deleted.

You'll know instantly not only that you've been hacked, you'll also know exactly which files have been tampered with.

There are also commercial firms that do this and much more.  The one we like and recommend is Sucuri.net.

Either of these solutions would have saved them a lot of grief.

Every owner of a WordPress website needs to be taking some elementary security measures these days.