WordPress administrators should educate themselves about secure password procedures and ensure that anyone with administrative access to their WordPress installation is aware of the risks. - Daniel Page
Hudson, FL (PRWEB) May 01, 2013
AHosting.net, a leading provider of premium web hosting services, has warned its clients and other WordPress users to take action to secure their sites against a wave of large botnet attacks that is currently seeking to exploit poor security configurations on WordPress sites.
Over the last two weeks, a new botnet constituted of over 100,000 botnet clients has been actively trying discover WordPress installations that are vulnerable to exploration with a brute force dictionary attack directed at the login page. The attack does not exploit an inherent vulnerability in WordPress itself or its dependencies, but attempts to log into administrator accounts by repeatedly guessing username and password combinations.
WordPress sites with sufficiently complex passwords and usernames are not at significant risk, but it is believed that accounts that have not been securely configured with a difficult-to-guess password are likely to be at risk of unauthorized access. Those sites that are breached are open to infection with a backdoor that will allow hackers permanent access to the site; the botnet is likely to also install a version of itself on hacked sites, making them part of the botnet.
"WordPress's enormous popularity makes it a prime target for hackers," commented Daniel Page, Director of Business Development at AHosting, Inc., "A properly maintained and updated instance of WordPress is very secure, but in this case, users' lack of security awareness may lead to exploitable misconfigurations. WordPress administrators should educate themselves about secure password procedures and ensure that anyone with administrative access to their WordPress installation is aware of the risks."
AHosting.net suggests that its clients and others who use the WordPress content management system take the following action to mitigate the risk of exploitation.
Firstly, WordPress administrators should ensure that all user accounts have sufficiently long and complex passwords that guessing them in a reasonable timeframe is unlikely. The qualities of hard to guess passwords are length, at least 12 characters made up of upper and lower case letters, numbers, and symbols. It is not advisable to use dictionary words or phrases made up of those words, unless such a combination is both rare and very long.
Secondly, if the default "admin" account is still active, it should be deleted. To reduce the number of possible guesses that the botnet has to work through, most of the attacks are being targeted at installations that use the default username. It is not possible to change the name of this account, so it should be deleted and replaced with an administration account with a new username and a secure password.
Any account that has implemented secure login credentials is at minimal risk of being hacked by this botnet.
AHosting is a managed web hosting provider with facilities in Orlando, FL, Detroit, MI, and Charlotte, NC, owned and operated by AHosting, Inc., supplying hosting services that are truly beyond imagination. Since 2002, AHosting has established one of the web’s premier solutions for reseller web hosting, multiple IP hosting, dedicated servers, and VPS hosting. For more information, visit http://www.ahosting.net.