Join the AMA (Ask Me Anything) with the Firefox leadership team to celebrate Firefox 20th anniversary and discuss Firefox’s future on Mozilla Connect. Mark your calendar on Thursday, November 14, 18:00 - 20:00 UTC!

Avatar for Username

Kërkoni te Asistenca

Shmangni karremëzime gjoja asistence. S’do t’ju kërkojmë kurrë të bëni një thirrje apo të dërgoni tekst te një numër telefoni, apo të na jepni të dhëna personale. Ju lutemi, raportoni veprimtari të dyshimtë duke përdorur mundësinë “Raportoni Abuzim”.

Mësoni Më Tepër

Kjo rrjedhë është arkivuar. Ju lutemi, bëni një pyetje të re, nëse keni nevojë për ndihmë.

Wordpress attack from mozilla products

ahsteve
ahsteve
more options

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack.

example logs

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"

There should be some security hole in the product which is helping the hackers to do it.

Steve

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack. example logs 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1" 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17" There should be some security hole in the product which is helping the hackers to do it. Steve

Krejt Përgjigjet (2)

philipp
philipp
  • Moderator
more options

hello, the two example logs you've provided are from a (outdated) firefox 16.0.1 & a chrome 24 installation. the Mozilla/5.0 string in front of a user-agent is used for historical reasons by all browser vendors & doesn't mean that it is coming from a mozilla product.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Sounds like a botnet attack. I am not aware of any botnet attacks that run through browsers, although, with such an open add-on model, it may well have been tried. However, that would not be very stealthy... It seems more likely that the bots simply forged the user agent strings to avoid detection and blocking.

There are plugins to blunt brute force attacks by slowing down retries, such as: http://wordpress.org/extend/plugins/login-security-solution/

Edit: Based on support forum postings for version 0.35 of the above plugin, do not use its feature to force all users to reset all passwords immediately installing.

Ndryshuar nga jscher2000 - Support Volunteer