Avatar for Username

Pomoc pśepytaś

Glědajśo se wobšudy pomocy. Njenapominajomy was nigda, telefonowy numer zawołaś, SMS pósłaś abo wósobinske informacije pśeraźiś. Pšosym dajśo suspektnu aktiwitu z pomocu nastajenja „Znjewužywanje k wěsći daś“ k wěsći.

Learn More

Toś ta nitka jo se archiwěrowała. Pšosym stajśo nowe pšašanje, joli trjebaśo pomoc.

Wordpress attack from mozilla products

ahsteve
ahsteve
more options

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack.

example logs

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"

There should be some security hole in the product which is helping the hackers to do it.

Steve

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack. example logs 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1" 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17" There should be some security hole in the product which is helping the hackers to do it. Steve

Wšykne wótegrona (2)

philipp
philipp
  • Moderator
more options

hello, the two example logs you've provided are from a (outdated) firefox 16.0.1 & a chrome 24 installation. the Mozilla/5.0 string in front of a user-agent is used for historical reasons by all browser vendors & doesn't mean that it is coming from a mozilla product.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Sounds like a botnet attack. I am not aware of any botnet attacks that run through browsers, although, with such an open add-on model, it may well have been tried. However, that would not be very stealthy... It seems more likely that the bots simply forged the user agent strings to avoid detection and blocking.

There are plugins to blunt brute force attacks by slowing down retries, such as: http://wordpress.org/extend/plugins/login-security-solution/

Edit: Based on support forum postings for version 0.35 of the above plugin, do not use its feature to force all users to reset all passwords immediately installing.

Wót jscher2000 - Support Volunteer změnjony