Source
r/Wordpress•
offminded

Wordpress vulnerability against bruteforce attacks(xmlrpc.php)

We have been experiencing server problems since last week. Normally we have varnish on front so we thought we were immune to server resource problems etc, but since last wednesday we had occasional server lags, 500 errors etc. We have seen server resources is being consumed with requests, for some reason varnish was not serving static html files.

Our wordpress core and plugins is updated to latest versions and there were no configuration problems.

When we checked the logs we have seen that these 3 files have been taking huge amount of hits from bruteforce attacks:

  • xmlrpc.php
  • wp-cron.php
  • wp-login.php

And since our varnish conf is set to bypass requests coming to these files, bots have been consuming huge amount of server memory, thus leading to server lags and 500 errors due to timeouts.

First we tried to redirect coming requests by .htaccess but soon realised it was not a good idea because bots posting bruteforce login info to index.php were bypassing varnish cache again and still using server resources.

We have disabled the wp-cron and xmlrpc and changed the login.php to another name. Right now everything seems normal. Bots attacks are stilll going on but not consuming system resources anymore.

I just wanted to post here so it might be helpful to others, since these bot attacks is spreading like wildfire.

Some links on the issue: http://www.saotn.org/huge-increase-wordpress-xmlrpc-php-post-requests/

http://wordpress.stackexchange.com/questions/110513/many-post-requests-to-xmlrpc-php-from-googlebot-taking-down-server

http://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html

Posted Aug 26, 2014, 1:55 PM UTC

56
HandsDeveloper•

You should set up serverside configuration to block IP addresses that are doing these sorts of attacks. The company I recently left had a server with around 50 wordpress sites on it and we got about 100+ unique IPs doing driveby bot attacks through various methods on a daily basis (everything from trying to log in to phpmyadmin to wp-admin to mail), I just set the server up to auto IP ban anyone who failed credentials repeatedly within 5 minutes. It's a jungle out there. Our server's ban list was several tens of thousands of IP addresses long.

2
r109•

Block all requests to xmlrpc.php

Or redirect all traffic to meatspin

Tell your host to block it with Mod Security.

2
yaazz•

I actually noticed this as well yesterday. xmlrpc.php was getting HAMMERED with requests. like several per second. This doesn't seem like much but it's the smallest possible instance on Amazon, so it can slow things down quick.

I looked through my access files to check the ip addresses that were accessing my server knowing full well that I was the only person who used this server and therefore ANY other IP addresses were malicious. Interestingly enough I found that there were only 3 or 4 different addresses that were hammering my server over and over. I simply blocked these addresses in .htaccess and the problem seems to be fixed, for now at least.

These same bots were also attempting to access phpmyadmin, for the record.

1
aieronpeters•

Install 'brute protect' plugin, or another brute-force defence plugin.

Brute force login attempts are a hazard of being on the internet, they tend to be against FTP/SSH/SMTP though. WordPress has grown big enough that they're now targetting WordPress.

A defence plugin (BruteProtect), or using ModSecurity or fail2ban (with requisite plugin) are the only way to go. You can't stop the attacks from coming, only negate them when they do.

We've a custom-coded protection mechanism that scans our access log files, it's banned over 10,000 individual IPs.

1
hawaiidesign•

the xmlrpc.php file on my main website was getting hammered too and it brought down all my websites, I just simple blocked the the file on my nginx server block and that did the trick.

1
r109•

op, just curious have you found anything about preventing comment spam with ModSecurity? I have a server that has a lot of WP hosted accounts and it seems to get hammered with comment spammers. I'm trying a few different SecRules but I'm wondering if there' are others. I'm fairly new to ModSecurity and I'm just learning.

1