Hackers target Wordpress

[Dodgeboard]

If you have Wordpress installed, be sure that you have removed the default "admin" account. The ones that still have the admin account are getting hacked.


http://venturebeat.com/2013/04/12/wordpress-botnet-attack/

http://techcrunch.com/2013/04/12/ha...steal-admin-passwords-and-gain-server-access/

“It’s a big attack directed at a significant percentage of the WordPress installs worldwide,” a company spokesperson said in the email.

 

[ManagerJosh]

We've been dealing with those attacks all last week and this week at work. Thankfully no accounts with the username admin, but we've been blocking IPs as fast as we can detect them.

 

[rdn]

Thanks, I don't have any wordpress site atm.

 

[x4rl]

Great >.> time to check about 20 wordpress sites #sigh

Thanks for the info tho.

 

[craigiri]

thanks for the tip - I did away with my admin on one site....
I will up the ante on the passwords also....

 

[surfsup]

If you have Wordpress installed, be sure that you have removed the default "admin" account. The ones that still have the admin account are getting hacked.


http://venturebeat.com/2013/04/12/wordpress-botnet-attack/

http://techcrunch.com/2013/04/12/ha...steal-admin-passwords-and-gain-server-access/

so all we have to do is change the username 'admin' to another username and were fine or...?

 

[Dodgeboard]

so all we have to do is change the username 'admin' to another username and were fine or...?

Yes, and as a preventative, make sure all your passwords are complex.

 

[Biker]

This is really overblown IMO. If you were to look at your security logs, you'd find the script kiddies have been hammering WordPress vulnerabilities for eons.

They're using a brute force dictionary attack. If your password can be looked up in a dictionary, you have bigger worries than this one.

 

[Paul B]

Damn!

I'd better change mine from Antidisestablishmentarianism then.

 

[Mike]

Damn!

I'd better change mine from Antidisestablishmentarianism then.

You mean it wasn't Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch?

 

[Ingenious]

There's a few things you can do with WP to make it a bit more secure. You can .htaccess protect the admin area for a start, then change the admin username to something else (plus make sure your password is very good). I used to get password reset emails sent from the site - someone fishing for (and finding) one of the admin emails, so I would change your registered email address to one NOT used by, or shown on, your site. Finally, you can install a plugin to limit incorrect logins.

 

[Paul B]

You mean it wasn't Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch?

I tried to say that once and almost choked on my own tongue.

 

[Keith Myers]

These attacks actually happen quite a bit only on a much smaller scale. Aside from changing the default admin username and using a strong password, it is best to add a .htpasswd file to the wp-admin directory with an additional password. It is even better to restrict the wp-admin to an IP address if possible.

 

[zooki]

You mean it wasn't Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch?

Did you write that whole name from memory?

 

[Adam Howard]

People actually use the user name "admin" ?

Wait.... That would mean people also keep using the user id #1 for such things as well?

^^ I know there are people out there who are still foolish enough to do so.... I just can't imagine why.

 

[zooki]

People actually use the user name "admin" ?

Wait.... That would mean people also keep using the user id #1 for such things as well?

^^ I know there are people out there who are still foolish enough to do so.... I just can't imagine why.

Is that sarcasm?

 

[SneakyDave]

Actually, within Wordpress code, you can't change the "admin" account to something else. You either have to delete it, and choose what to do with the posts you've created with it, or install something like WordFence to limit password attempts, which is probably the easier option.

What's so foolish about having a userid of '1' Adam? You use it yourself on your own site.

 

[SneakyDave]

Just changed all my passwords from "12345"

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[Ingenious]

Actually, within Wordpress code, you can't change the "admin" account to something else.

Do you mean the username "admin"? You can change it easily enough using PHPMyAdmin to just edit the username in the database. However for new installs you apparently get the option to change the name when you're setting up.

 

[SneakyDave]

Yes. you can run a query to change it, but if it was easy enough to change it that way, why doesn't WordPress let you change it in the user admin section? It seemed to me that it might break a bunch of other things, changing the username, if WP actually says "User name can not be changed" in the administration panel.

EDIT:
This site seems to ignore the WP warning regarding user names, and claims that changing the username is as simple as updating it in the wp_users table:
http://wpmu.org/how-to-change-your-wordpress-username/

This commenter thinks that other username data has to also change in the database....

If I remember correctly, the catch with the approach that you suggest is that for WordPress networks the user name is also added to the user meta data as part of a serialized array.
So for networks it’s necessary to also change the name in that array, and then, if the length of the new name doesn’t match that of the old name, to also tweak the data that defines the array’s structure.
I believe that this is why the seemingly straightforward option isn’t available in the WP Admin.