Yesterday we got to know of a massive brute force attack on WordPress admin accounts targeting weak passwords.
From an online source:
A botnet using more than 90,000 IP addresses to crack WordPress admin accounts may be used as part of a larger plot to disrupt online users, according to researchers.
WordPress users with the “admin” username are being targeted by a botnet consisting of compromised home PCs. The infected machines are brute-force hacking accounts, automatically inputting a list of commonly used passwords.
All that we know right now is that some 90,000 unique IP addresses were involved in this attack. Although the details of the attack will probably become public once the investigations get thorough, I wish to ask a generic question:
- Earliest bots were known to be IRC based. The latest trends of Bots has been towards P2P. What all information is sufficient or necessary for a domain expert to judge/conclude what type of Botnet was used in a particular attack- IRC, HTTP or P2P?
- And what conclusions can be drawn right now for the Wordpress attack?
I am not inviting speculations here, but some good answers (with good logics) in the spirit of this one by the Big Bear.