Having a default username in the first place is incredibly poor practice. So many users stick to 'admin', making it just a case of guessing the password.
And don't get me started on that bloody "the loop" finite state machine. I mean, really?
WP is a good platform that does a lot out of the box (performance could use some work too though), so I don't think we should throw the baby out with the bathwater. There's just some housekeeping that needs to be taken care of beforehand.
The alternative, of course, is building something custom with the bare minimum of necessities server-side and scrubbing all input/global vars. A lot of flexibility can still be retained by implementing a taxonomy system that define what posts can be (which is pretty much a very loose Entity-Attribute-Value model).
With over 200k different botnet controlled machines, all that tracking the IP sources would do here is create massive blocklists. There's already evidance growing that the botnet is trying 2-3 passwords per source IP - effectively bypassing existing limiting plugins.
A solution to the above is to limit the logins per account per timeframe, but that just locks the legitimate users out, causes the botnet to spread out the attack over longer periods, and ultimately only has a negitive affect for the user.
The Hosts are feeling the pain though, i've seen some hosts are disabling access to wp-login.php entirely, this tells me that the shared hosts are having resource issues, so a limit-login style plugin would do zero to help them, it'd still cause massive problems for the host.
WordPres, Joomla, and other smaller CMS's are being targetted here, so this is by no means just WordPress's problem either.
Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/
The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wor...
Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.
Two-factor auth is not just about rendering dictionary attacks ineffective.
For 2/3 of the WordPress sites I administer, I use a very long, complex admin password. The other site is for a group that wanted multiple admin accounts, but the people who use these accounts have a lot of trouble with complex passwords. After several emails telling me that "the website doesn't work" because the user had trouble with a long password with special characters, I gave up and switched it to an easy-to-remember password with just uppercase and lowercase letters.
https://github.com/mojombo/jekyll/wiki/blog-migrations
P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.
What about non-technical users? Multi-author blogs? Idiot-proof extensibility? Updates from phones and tablets? Huge sites with thousands of posts? Editorial and review systems? Access to thousands of cheap or free themes?
The ideal static site user is in a pretty privileged group. Most WordPress users would be better off securing WordPress and using a caching plugin that gives them the benefits of a powerful, dynamic platform while serving static files with automatic serverside compilation: http://wordpress.org/extend/plugins/wp-super-cache/
At the very least, it needs something like http://prose.io/ on top of it, and since their website keeps not working, you don't want to put all your eggs in one basket, if shit hits the fan.
WordPress
1) Beginner friendly
- One doesn't need to be a coder or mess with cmd to use it.
- Abundance of tutorial(text/audio/video)
- You can host it anywhere, even for free. FTP? I know that from work.
- Hosting provider even install it for you
- Expert support is all over the web
- Drupal and Joomla can't beat WordPress new user adoption, why? They're made to be customized(more developer-centric). Too much option is apparently not good for new user.
2) Features
- Need something? there's plugin for that
- People/visitors loves nice design/layout, WordPress have thousands of themes
- Secure. Attacked by some random ddos/script kiddies? Hosting provider will take care of it. Malicious code? same case.
Static site generator.
1) Beginner friendly
- Yes, at least if you're familiar with cmd.
- Most tutorial suggesting Amazon S3/CDN/cloud etc. Well those service are inaccessible to many.
- Write new post, generate, upload...complicated!
- Lets embed image/audio/video with one-click...nope!
- Lets edit old blog post... oh why art thou so hard
- Lets try it on my phone, nope!
2) Features
- I want to add Facebook comment, how? Read the manual, download that, configure...blabla. No thanks
- Lets add analytics code. Edit template and insert this javascript, save and regenerate...blabla. No thanks
Conclusion : it might be a piece of cake for you but not to most people. Remember "most user are idiot"?. If I want to have simple static blog with nice editor I would use Blogger. Dumping random text? I have pastebin for that. Static site generator sure is attractive but we are just not there yet.
I have a feeling that 'campaign' to promote static site generator to WordPress user is strikingly similar to Windows-to-Linux campaign. It just never going to happen for most user, at this rate.
> - Most tutorial suggesting Amazon S3/CDN/cloud etc. Well those service are inaccessible to many.
Because you just need to serve static content, there are more options than for Wordpress, incl. Google and Github.
> - Write new post, generate, upload...complicated!
Not at all:
1. Create a new post: rake new_post["title"]
2. Edit using your favorite editor
3. Sync: rake deploy
There are tags for that, i,e, {% img /img/pic01.png %}
> - Lets edit old blog post... oh why art thou so hard
You can edit any post. They are in folders sorted by year and month.
> - Lets try it on my phone, nope!
Correct.
Conclusion: Blogging this way seems complicated, but is isn't if you are really doing it. Please try it for sake of a faster and safer Internet.
In my experience people get compromised due to bad folder permissions or old versions of WP. I hadn't considered brute-force password attacks.
I use it pretty much everywhere that I have anything to do with WordPress - I'd noticed an uptick early this week of random ip addresses from far-flung countries getting locked out after 5 login attempts or multiple lost password attempts.
(One site in particular gets a _lot_ of drive-by login attempts - it's got the word "anonymous" in the domain, which I suspect attracts mostly the wrong sort of traffic... Wordfence is locked down _much_ tighter on that site.)
And the 'live scan' is scary -- constant attempts to login as 'admin'.
The difficulty with the democratisation of software and web development is that inevitably, people will make mistakes like this. The sad part is there's probably millions of articles explaining why this is a bad idea, but the people most at risk will never see them.
I'm a little surprised that such a simple attack vector is a legitimate threat in creating a "super botnet."
8.5% have the passwords password or 123456;
9.8% have the passwords password, 123456 or 12345678;
14% have a password from the top 10 passwords
40% have a password from the top 100 passwords
79% have a password from the top 500 passwords
91% have a password from the top 1000 passwords
No wonder everyone stuck with 'admin'.
Find a good host, use a secure password password, pay attention to the 3rd party plugins you're installing, and keep your install updated.
This is what the bruteforce passwords look like, these tried to login as "admin":
[Sat Apr 13 05:30:31 2013] nevalidniipass
[Sat Apr 13 05:30:34 2013] gfhjkm
[Sat Apr 13 05:30:37 2013] gggggggg
[Sat Apr 13 05:30:39 2013] ghbdtn
[Sat Apr 13 05:30:41 2013] ghgftmn6
[Sat Apr 13 05:30:43 2013] ghghgh
[Sat Apr 13 05:30:44 2013] ghjkju
[Sat Apr 13 05:30:46 2013] ghjrdjcn
[Sat Apr 13 05:30:48 2013] gjkzyjxr
[Sat Apr 13 05:30:50 2013] globax123
[Sat Apr 13 05:30:52 2013] go0gle
[Sat Apr 13 05:30:54 2013] go2fuck
[Sat Apr 13 05:30:55 2013] gogogo
[Sat Apr 13 05:30:57 2013] goldz
[Sat Apr 13 05:30:59 2013] gthtw112
[Sat Apr 13 05:31:02 2013] guest
[Sat Apr 13 05:31:05 2013] h69s9t
[Sat Apr 13 05:31:07 2013] hackett
[Sat Apr 13 05:31:08 2013] hal9000
[Sat Apr 13 05:31:10 2013] hazem200
[Sat Apr 13 05:31:12 2013] heccrbqh
[Sat Apr 13 05:31:14 2013] herbie
[Sat Apr 13 05:31:16 2013] hghgh
[Sat Apr 13 05:31:18 2013] hhhh1
[Sat Apr 13 05:31:20 2013] hhhhhaaaaa
[Sat Apr 13 05:31:21 2013] hockey
[Sat Apr 13 05:31:23 2013] home555
[Sat Apr 13 05:31:25 2013] honda
[Sat Apr 13 05:31:27 2013] htrdbtv
[Sat Apr 13 05:31:29 2013] http
[Sat Apr 13 05:31:31 2013] hycvibck
[Sat Apr 13 05:31:33 2013] i_am
[Sat Apr 13 05:31:35 2013] ib6ub9
[Sat Apr 13 05:31:37 2013] icing
[Sat Apr 13 05:31:38 2013] icq123
[Sat Apr 13 05:31:40 2013] icqpass
[Sat Apr 13 05:31:42 2013] if6was9
[Sat Apr 13 05:31:44 2013] ifhgtq79
[Sat Apr 13 05:31:46 2013] ifyfif
[Sat Apr 13 05:31:48 2013] iiiiiiii
[Sat Apr 13 05:31:50 2013] ikaihsot
[Sat Apr 13 05:31:52 2013] il0vey0u
[Sat Apr 13 05:31:54 2013] iloveaol
[Sat Apr 13 05:31:56 2013] iloveu
[Sat Apr 13 05:31:57 2013] iloveyou
[Sat Apr 13 05:31:59 2013] inferno
[Sat Apr 13 05:32:01 2013] infinity
[Sat Apr 13 05:32:05 2013] infree
[Sat Apr 13 05:32:08 2013] iof314
[Sat Apr 13 05:32:11 2013] jake4440
[Sat Apr 13 05:32:13 2013] jamie1
[Sat Apr 13 05:32:15 2013] janice
[Sat Apr 13 05:32:16 2013] jay18birdman
[Sat Apr 13 05:32:18 2013] jc5000
[Sat Apr 13 05:32:20 2013] jeffery
[Sat Apr 13 05:32:22 2013] john1
[Sat Apr 13 05:32:24 2013] joomla
[Sat Apr 13 05:32:26 2013] joshua
[Sat Apr 13 05:32:27 2013] keys
[Sat Apr 13 05:32:29 2013] kholmsk3
[Sat Apr 13 05:32:31 2013] kir11421
[Sat Apr 13 05:32:33 2013] kkkkkk
[Sat Apr 13 05:32:35 2013] kngvhpg
[Sat Apr 13 05:32:37 2013] ko#]|7sz
[Sat Apr 13 05:32:39 2013] kxvq4k2d
[Sat Apr 13 05:32:41 2013] laksmi
[Sat Apr 13 05:32:42 2013] lefty
[Sat Apr 13 05:32:44 2013] lex1977
[Sat Apr 13 05:32:46 2013] linux
[Sat Apr 13 05:32:48 2013] lol
[Sat Apr 13 05:32:50 2013] lol777
[Sat Apr 13 05:32:52 2013] lollol
[Sat Apr 13 05:32:54 2013] lovelove
[Sat Apr 13 05:32:55 2013] lucille2000
[Sat Apr 13 05:32:57 2013] lyxasgje
[Sat Apr 13 05:32:59 2013] m@$ter
[Sat Apr 13 05:33:02 2013] m@ster
[Sat Apr 13 05:33:07 2013] m1911a1
[Sat Apr 13 05:33:11 2013] google
[Sat Apr 13 05:33:13 2013] facebook
[Sat Apr 13 05:33:15 2013] microsoft
[Sat Apr 13 05:33:17 2013] obama
[Sat Apr 13 05:33:18 2013] twitter
[Sat Apr 13 05:33:20 2013] wp
[Sat Apr 13 05:33:22 2013] wordpress
[Sat Apr 13 05:33:24 2013] 060890
[Sat Apr 13 05:33:26 2013] 060891
[Sat Apr 13 05:33:28 2013] 060893
[Sat Apr 13 05:33:30 2013] 060988
[Sat Apr 13 05:33:32 2013] 060989
Here are some more observations which I made during the last months:
Most of the time it seems that the attackers are using a list of popular passwords, the same passwords appear over and over again: 12345, qwerty, 1q2w3e4r, and so on.
Most of the time they try to login as "admin", "Admin", "administrator", "root" or the name of the domain or blog or a part of that name, for example omitting a ".com".
In the HTTP requests, the parameters "log" (for the user name) and "pwd" (for the password) are always transmitted, but the parameters "wp-submit=Log In" and "testcookie=1" are not always transmitted.
Many of these attacks do not transmit a user-agent field in the HTTP headers. Blocking the empty user-agent seems like a good idea to me.
These attacks look simple, but I guess that they are successful on a big number of sites.
There's some more about this on their blog:
http://blog.cloudflare.com/patching-the-internet-fixing-the-...
Then I saw the source for this "news": Cloudflare's blog.
2) WP Better Security
3) WPScan (https://github.com/wpscanteam/wpscan)
Should be sufficient for most small/medium installation
Seriously, the security of password protected systems are a disaster(, when combined with the average user).
We should push static content generators like jekyll & co the reduce the surface, till somebody solves the authentication problem.