WordPress and Security - SANS Internet Storm Center

Participate: Learn more about our honeypot network
https://isc.sans.edu/tools/honeypot/

Handler on Duty: Xavier Mertens

Threat Level: green

WordPress and Security
The state of the systems we use in our day to day lives, typically outside our place of business, is ours to use and abuse as we see fit. As such, we are also responsible for the security of said systems, and one of the oft overlooked is WordPress. The WordPress application is used by many SOHO users, and is as vulnerable to attack as anything out there today. WordPress can be be secured, and with a bit of effort and guidance, fairly easily. The WordPress.Org site has a great hardening guide for WordPress that covers most of the aspects of security and bringing it to their application. http://codex.wordpress.org/Hardening_WordPress If the instance of WordPress is running on a shared server, as most are, then working with the local hosting company may be necessary if they are behind on patching, updating, etc. If their host is compromised, then everything you do for your instance of WordPress can be easily undermined at the OS level. If you choose to use tools, such as Metasploit or ZAP to test your application, ensure it is done within the confines of the User Agreement in place for your hosting site. tony d0t carothers --gmail	Tony 150 Posts ISC Handler Jun 19th 2014
Thread locked Subscribe	Jun 19th 2014 8 years ago
My web server logs have seen a large uptick lately in what I assume are either WordPress attack attempts or WordPress enumeration scans. 184.107.243.218 - - [18/Jun/2014:14:48:21 -0600] "POST /wp-login.php HTTP/1.1" 404 277 212.227.119.139 - - [18/Jun/2014:14:57:12 -0600] "POST /wp-login.php HTTP/1.1" 404 277 50.87.144.147 - - [18/Jun/2014:15:06:07 -0600] "POST /wp-login.php HTTP/1.1" 404 277 200.234.196.228 - - [18/Jun/2014:17:42:11 -0600] "POST /wp-login.php HTTP/1.1" 404 277 46.249.202.200 - - [18/Jun/2014:17:50:33 -0600] "POST /wp-login.php HTTP/1.1" 404 277 And the hosting companies don't seem to understand or care.... Here is one response I received from Tyler at Handy Networks when I reported it... ------ Hello, A single hit to a page leads me to believe that this host is not compromised. Please provide more evidence of such behavior so that I may investigate. For now, I'm marking this ticket resolved. Thanks,	K-Dee 68 Posts
Quote	Jun 19th 2014 8 years ago
Quoting K-Dee:My web server logs have seen a large uptick lately in what I assume are either WordPress attack attempts or WordPress enumeration scans. 184.107.243.218 - - [18/Jun/2014:14:48:21 -0600] "POST /wp-login.php HTTP/1.1" 404 277 212.227.119.139 - - [18/Jun/2014:14:57:12 -0600] "POST /wp-login.php HTTP/1.1" 404 277 50.87.144.147 - - [18/Jun/2014:15:06:07 -0600] "POST /wp-login.php HTTP/1.1" 404 277 200.234.196.228 - - [18/Jun/2014:17:42:11 -0600] "POST /wp-login.php HTTP/1.1" 404 277 46.249.202.200 - - [18/Jun/2014:17:50:33 -0600] "POST /wp-login.php HTTP/1.1" 404 277 There's not much that they can do about it. I personally do a 301 redirect to a port I have a TCP tarpit running on. A slightly more aggressive response would be to note the IP address and update the firewall to direct all traffic from that IP to a TCP tarpit port. You might have to put up a fake wp-login.php page to get them to bite and try a second connection to get tarpitted... Of course, this all depends on how much control you have over your website host system.	John Hardin 62 Posts
Quote	Jun 19th 2014 8 years ago
I've been very pleased with features and functionality of the plugin: All In One WP Security I agree, though, that all is for naught if my hosting company fails to apply appropriate and prompt updates and patches.	T 31 Posts
Quote	Jun 19th 2014 8 years ago