Avatar for Username

ძიება მხარდაჭერაში

ნუ გაებმებით თაღლითების მახეში მხარდაჭერის საიტზე. აქ არასდროს მოგთხოვენ სატელეფონო ნომერზე დარეკვას, შეტყობინების გამოგზავნას ან პირადი მონაცემების გაზიარებას. გთხოვთ, გვაცნობოთ რამე საეჭვოს შემჩნევისას „დარღვევაზე მოხსენების“ მეშვეობით.

ვრცლად

ეს თემა დაარქივებულია. დასვით ახალი კითხვა, თუ დახმარება გესაჭიროებათ.

Wordpress attack from mozilla products

  • 2 პასუხი
  • 2 მომხმარებელი წააწყდა მსგავს სიძნელეს
  • 3 ნახვა
  • ბოლოს გამოეხმაურა jscher2000 - Support Volunteer

ahsteve
ahsteve
more options

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack.

example logs

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"

There should be some security hole in the product which is helping the hackers to do it.

Steve

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack. example logs 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1" 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17" There should be some security hole in the product which is helping the hackers to do it. Steve

ყველა პასუხი (2)

philipp
philipp
  • Moderator
more options

hello, the two example logs you've provided are from a (outdated) firefox 16.0.1 & a chrome 24 installation. the Mozilla/5.0 string in front of a user-agent is used for historical reasons by all browser vendors & doesn't mean that it is coming from a mozilla product.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Sounds like a botnet attack. I am not aware of any botnet attacks that run through browsers, although, with such an open add-on model, it may well have been tried. However, that would not be very stealthy... It seems more likely that the bots simply forged the user agent strings to avoid detection and blocking.

There are plugins to blunt brute force attacks by slowing down retries, such as: http://wordpress.org/extend/plugins/login-security-solution/

Edit: Based on support forum postings for version 0.35 of the above plugin, do not use its feature to force all users to reset all passwords immediately installing.

ჩასწორების თარიღი: , ავტორი: jscher2000 - Support Volunteer