4

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and passwords. A quick bit of research shows me that after a successful attempt this function will return whether or not the user is an admin.

I use the IP Blacklist Cloud Plugin as part of my security so it logged the attack, but because this attack method doesn't use the normal login method no actual blacklisting happens. Which isn't likely to help anyway, because after every single attempt the attacker used a new IP (totaling over 15000 IPs so far)(20,000+ for a second attack).

I did find a plugin that completely disables the XML-RPC (API), but I'm not sure that won't cause other problems. This is a live website for a local municipality, so I cannot afford to experiment very much.

here is an example of what got logged in IP Blacklist Cloud:

"1.0" encoding="iso-8859-1"?>wp.getUsersBlogsusernamepassword

Where usernamepassword will be replaced by something from a giant list of popular usernames and passwords.

The attack seems to be gaining popularity, so I hope that spawns some more solutions.

Update 20140728:

One more site of mine played victim to this attack over the weekend. So far strong passwords have kept me safe, but others may not be so lucky. I am trying the above mentioned solution as it seems to be the best one I have found yet.

Links to more research:

API for WordPress XML RPC http://codex.wordpress.org/XML-RPC_WordPress_API

Least intrusive solution so far http://www.cryptobells.com/more-wordpress-xmlrpc-brute-force-attacks/

WordPress Support forum http://wordpress.org/support/topic/recent-new-xmlrpcphp-brute-force-password-guessing-attack-details

  • 1
    Could you point to / quote said research? It's not completely clear from your description how it exposes that information. – Rarst Jul 7 '14 at 16:20
  • codex.wordpress.org/XML-RPC_WordPress_API/Users Shows that the return value (if successful) includes a boolean for isAdmin – KnightHawk Jul 7 '14 at 16:21
  • even without the isAdmin value the attacker would get confirmation of a successful username/password combination. – KnightHawk Jul 7 '14 at 16:23
1

This is the most specific solution I could find as it disables only the single function being attacked.

functions.php:

function Remove_Unneeded_XMLRPC( $methods ) {
    unset( $methods['wp.getUsersBlogs'] );
    return $methods;
}
add_filter( 'xmlrpc_methods', 'Remove_Unneeded_XMLRPC' );

found this at: http://www.cryptobells.com/more-wordpress-xmlrpc-brute-force-attacks/

For a broader solution there is a WordPress plugin called "Disable XML-RPC" which does precisely that, disables the entire XML-RPC functionality.

  • been two weeks, so far, so good – KnightHawk Aug 15 '14 at 13:21
  • it's been over a month now, and the sites which I employed this tactic have shown no further signs of the attack. It is unknown if it is coincidence or if it is success, but everything appears to be functioning as intended. – KnightHawk Sep 12 '14 at 14:17
-1

I have same issue for hacking my wordpress websites. Then i have create new user for administrator access and delete default admin user. Then i have installed below plugin and do it's required setting. iThemes Security Wordfence

Let me know if you have any query.

Thanks

  • no joy on removing the admin user as I never use that to begin with. Either way it's trivial to build a list of all usernames for a wordpress site. (wordpress leaves it in the author's page for all to see if they know where to look) Also, neither of those plugins have anything on their documentation that tells me it will stop this specific type of attack. Thanks anyway. – KnightHawk Jul 10 '14 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.