6

I have a wordpress site (fully patched) that used to receive many attempts to log in based on dictionary attacks. I changed my admin user to something uncommon and use a really strong password.

Apart of that I changed my login page using rename wp-login.php plugin. I changed my login url to something like http://foo.com/blog/?pencil. For years the bots failed to guess my login page (still having many 404s).

For the second time in a month. First time I had a failed attempt and changed url to http://foo.com/blog/?paper and didn't think much about it. Second time happened today. Exact events:

19th April

  • Successful login from my employer office (via proxy) to http://foo.com/blog/?pencil at 18:00 from my company laptop.
  • 2 failed attempts from 70.32.73.128 (report about the IP ), a IP from California, at 02:54am GMT (The server seems to be reported as hacked) using admin username (that btw doesn't exist in my wordpress)
  • I changed password and url to http://foo.com/blog/?paper
  • I enabled capturing of incoming passwords in log.

Now

  • Yesterday (11:10 am) I accessed to blog to correct an entry from my employer network (same proxy).
  • Today at 11:55 1 failed attempt from 213.248.63.27 (Virus Total report about the IP), a russian IP with suspicious sites like vrn.sauna.ru (probably NSFW url). It used oscarfoley as username with no password (my username is not oscarfoley or similar)

I feel pretty secure as the bot has to guess the login page, the admin user and the pass. However, by reading this site I am a little bit paranoid. So my main question is:

How the bot has "guessed" the paper or pencil login page?

  • Could be my employer proxy/network be compromised? (Like a hacker having access to proxy logs...)
  • Could it be a broad dictionary attack (something like a boot scanning all wordpress servers in the internet to see if the login page is pencil)?.. or a exploit in wordpress?
  • Is there anything more I should do to protect myself?
  • Could it be a personal attack using public information on internet? Or a bot that uses public information for broad attacks?
  • Why the empty password?
  • How can I be sure I am not hacked? (Forget about this as it is pretty good answered in this question)
  • Could be my laptop or my pc at home be hacked and got the url from it? My guess is no because otherwise they would have my password...

EDIT: To be more clear, attacker hit the login url directly with NO failed attempts on other similar urls. Check here last 404 errors: 404 screenshot

  • 2
    Does the name Oscar Foley appear anywhere on your blog, so that it is reasonable that a bot could have scraped it somehow? If not, perhaps it is a targeted attack. – Anders May 11 '16 at 13:41
  • 2
    Yes it does. The blog is oscarfoley.com :-) – Oscar Foley May 11 '16 at 13:43
  • 2
    Why the empty password? Perhaps to check if the username exists? If the login page says something like "invalid password" vs "invalid username", that could tell them if they should even bother trying to guess the password. – Alexander O'Mara May 11 '16 at 13:58
  • @Alexander That makes sense. It is good practice to just refuse login with invalid credentials, without giving away too much information. – David Glickman May 11 '16 at 14:29
  • Are you saying that the bot is hitting your login page directly without trying and failing many other urls? – TTT May 11 '16 at 14:30
2

Many web scanning tools (e.g. Wikto) have the capabilities of launching bruteforce guesses against a URL. There is nothing stopping an attacker from using a dictionary and say curl or wget to bruteforce either:

while read line
 do
   wget -qO - http://yoursite.com/$line
 done < /usr/share/dictionary/wordlist

A common task I would do for pentesting, would be something similar to the above, where I would wget a copy of the site, parse out each word, put each word on a newline, then search the site for directories of any word listed on their site. This also came in handy for username a few times.

Now you mention wordpress, and it should be stated that when you use plugins, some of those plugins can contain "pingbacks" or "hey I also use this plugin" where your site would be listed. This could be another vector where an attacker saw your site elsewhere, and targeted it. As for WP in general, sites like "Scritch" can tell someone what is running on the site (CMS), what plugins are in use, etc. So imagine the following: Attacker sees your site on say a pingback, takes the site name, shoves it into scritch. Determines they will attack you. They don't find the login page, so they use a similar tactic (shell script) to find something.

I would worry little about attackers, and focus on creating say a mod_rewrite rule or htaccess file similar to the following:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?oscarfoley\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin-login$
RewriteCond %{REMOTE_ADDR} !^1\.2\.3\.4$
RewriteCond %{REMOTE_ADDR} !^5\.6\.7\.8$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule> 

Where 1.2.3.4 is your home addr, and 5.6.7.8 is perhaps your company page and be done with the worries of someone trying to bruteforce their way in via login page. Another alternative which is security through obscurity would be to create a URL based on say a SHA1 checksum of a word, versus a word. E.g.

$ echo 0sc@r | shasum5.16 -a 1
2ee681adc62a5ca2865bb7424b6a97a9050ddcd4  -

Where 2ee681adc62a5ca2865bb7424b6a97a9050ddcd4 becomes your login URL. Again, security through obscurity, but the notion here is that is someone were to guess that URL at some point, you can deduce that your traffic was somehow sniffed, or cached somewhere.

ADDED DUE TO OP EDIT

The 404s from one address mean little to some degree. You have no idea if that address connecting is working in connection with another address doing bruteforce attempts. (e.g. distributed scanning/sharing)

  • Interesting. What I see from the 404 logs is that I have few guess attempts and surprisingly no failed wp_login.php 404s... – Oscar Foley May 11 '16 at 14:45
  • @OscarFoley when you say failed (404) what is your correlation for failures? Is it based on what you show in your image? The proper method to determine (baseline) what may have occurred is to look at all of your logs. How many 404s overall can you attribute over time to this activity? Example, if over the course of say 6 months, you start seeing patterns, there is a potential for association. E.g. seeing two 404s every 30 hours, 48 hours, etc – munkeyoto May 11 '16 at 14:49
  • I posted an screenshot of logs from March to today. Reviewing all the logs I see zero attempts to guess wp_login.php or guessing urls like pencil, paper, etc. – Oscar Foley May 11 '16 at 14:57
  • @OscarFoley in your "successful" attempt mention (where you state you used the word pencil and then the attacker did) where there any other successful attempts. My guesses would be the following. If the attacker went (spot on) to something as obscure as pencil there are three things that come to mind 1) the pingback I mentioned 2) your traffic was sniffed or 3) somehow that URL was perhaps cached when you logged in at somepoint, and perhaps someone Googled "site: oscarfoley.com" – munkeyoto May 11 '16 at 15:05
  • No, there were no other attempts. I use the blog ocasionally as I store there some PowerShell code ideas and base scripts. I only log in for private posts. – Oscar Foley May 11 '16 at 15:10
1

Well, pencil and paper do go together.... so maybe the attacker just guessed after finding

?pencil
Why not just make it a randomly generated thing using something like pwgen, with a ridiculously large length, like 50, so something like
/0gGF9ZAt7us0WbnntE3rqqrRK1PohXjU6Kk6tuRfCMMJdJmZIf
as a login page and login being equally ridiculous?

  • As for guessing - maybe just a dictionary attack – PMARINA May 11 '16 at 13:56
  • 2
    Shouldn't a dictionary attack have several attempts? (Many) – Oscar Foley May 11 '16 at 14:13
  • 3
    @OscarFoley is it possible to find the URL by looking at the source (viewable from browser, not source code) on your website? Maybe there's a link someplace or HTML that is giving him the admin login, which also includes the Robot.txt file. – dakre18 May 11 '16 at 14:16
  • 1
    @OscarFoley Oh right. Maybe it's your proxy or someone has a keylogger on your pc. The ips might not even be relevant if they are using the onion browser or something like it. Thanks for the warning about the nsfw url, I almost went to the website to see what it was. Also, you might have it in your browser history, which could be synced across computers, and someone has your login or has a computer in which you logged in (library, cafe) – PMARINA May 11 '16 at 14:17
  • 3
    @PMARINA, if someone had a keylogger at my pc they would have the password. I only have logged from home and work (in the uncommon situation I had to log from a public place I would use VPN). Suspiciously both times I had recently logged in from work so I suspect it could be the proxy logs... – Oscar Foley May 11 '16 at 14:27
1

your solution is IP-based login page. I.e. you have a list of static IP's, they're allowed to open actual login page, others are redirected to a trap to collect username and password for a break-in attempt + blacklist an attacker's IP. Where from it can be guessing? An answer is... your browser toolbars/addons + antivirus "security software". Yes, they DO leak data. Also your employer's proxy logs may be of suspect. Try a blank Linux installed on a Raspberry Pi 2 with blank browser with no addons - and use it and it ONLY to log in to your wordpress, not use it from your employer's proxy. And take a look - will the new login address be in use.

  • You might be right. I use xmarks, pocket and lastpass. Your solution (Raspberry PI) would work but is not usable for me. – Oscar Foley May 11 '16 at 15:20
  • @OscarFoley then try to make an HTTPS by-cert authenticated login page accessed as a Tor hidden service? – Alexey Vesnin May 11 '16 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.