Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such as 8.8.8.8 (google's public dns) as the origin of some of the login attempts.

I use WordFence to detect and block these attempts, but the block is based on IP, so it's not so efficient.

My question is:

  • Is it 'normal' for low profile WordPress sites to get these 'attacks'? I've notices an increase in the logs during the first days of 2013.

  • Is it something to worry about, and is it possible to detect/verify if a login request is coming from a spoofed IP?

share|improve this question
5  
Spoofing IPs shouldn't be possible with TCP. How are you detecting the IP? Do you trust the forwarded-for header? – CodesInChaos Jan 13 at 17:05
Clarification: Spoofing source IP addresses is possible but few routers forward the packets and if they do, TCP communication is not possible. – Cristian Dobre Jan 14 at 8:35
thanks for the comments, I'll ask the developer of WordFence, how the IP's are determined. – mwb Jan 14 at 10:39

1 Answer

up vote 5 down vote

Its impossible to spoof your ip address of a TCP connection due to the 3 way handshake.... Unless of course the application is vulnerable to CWE-291: Trusting a Self Reported IP address

Sure enough in ./wordfence/lib/wfUtils.php on line 77:

public static function getIP(){
    $IP = 0;
    if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
        $IP = $_SERVER['HTTP_X_FORWARDED_FOR'];

So yes, the reason why you are seeing brute force attempts from 8.8.8.8 is because WordFence is vulnerable to CWE-291. I am reporting this vulnerability to WordFence, but to be honest this vulnerability is so painfully obvious. If the developer doesn't understand even the most basic flaws of trusting attacker input, then they have probably made other serious mistakes that impact security, I smell blood.

Its possible that a security system can make your system as a whole less secure. This is nothing new, remote code execution vulnerabilities have been found in anti-virus software. Complexity is the worst enemy of security.

share|improve this answer
Great finding! Is there a way of remotely detecting this without having access to source code or server logs? – Cristian Dobre Jan 14 at 17:31
@Cristian Dobre you could try setting your x-forwarded-for http header and see if the application changes behavior. Related: blog.ircmaxell.com/2012/11/anatomy-of-attack-how-i-hacked.html – Rook Jan 14 at 17:35
I think the rationale for trusting HTTP_X_FORWARDED_FOR (and HTTP_X_REAL_IP) over $_SERVER['REMOTE_ADDR'], which is the IP of the TCP connection, is because most transparent proxies set those headers. Since it's not really doing any authentication based upon those IPs (at least I hope WP doesn't use any kind of IP-based authentication), I wouldn't go as far as calling it a vulnerability. It's just a question of what is more likely to be the real IP: the TCP IP or the one set in those headers. – Null Jan 14 at 18:33
1  
@Null this flaw completely bypasses the security system they are trying to implement... but in the grand scale i agree its not critical. However, this is an inexcusable mistake for a security professional to make, I would expect that they have made even more egregious mistakes. – Rook Jan 14 at 19:39
1  
@Rook Reverse proxy configs don't provide client IP on the socket data. – Mark Maunder Jan 19 at 22:51
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.