5 ms·
You're right. It was probably a brute force since they don't have maximum login attempts. http://blogs.skype.com/wp-admin http://blogs.skype.com/wp-admin
by t0 13y ago
You're right. It was probably a brute force since they don't have maximum login attempts. http://blogs.skype.com/wp-admin http://blogs.skype.com/wp-admin
- elwell 13y agoSuch a simple feature to implement...
- devinegan 13y agoIt does appear to be a brute force or phishing attack. These sort of drive-bys can typically be permanently stopped with 2FA or a password-less MFA solution like LaunchKey (Disclaimer: co-founder). LaunchKey has a free WordPress Plugin available, among others: http://wordpress.org/plugins/launchkey/ http://wordpress.org/plugins/launchkey/ It is 2014, you better prepare a good PR response for when you get breached OR start implementing stronger authentication ASAP.
- Ergomane 13y agoIt is only a simple feature if you don't care about DOS against the user account and do not have an adversary with a large botnet.
- Viper007Bond 13y agoLimiting login attempts is not as effective as you might think. How should it work? If you want to ban IP addresses that get X attempts wrong in Y minutes, then you're failing to realize that hackers like this normally have access to hundreds or thousands of IP addresses. If you want to lock the whole account for a while, then you've just introduced a way for anyone to lock the account of someone else they don't like. Also considering that their Twitter and Facebook accounts were also compromised, your assumption that it was the blog itself that was compromised is a big one. I don't have any first hand knowledge on that though personally, I'm just saying.
- Spearchucker 13y agoNo need to ban an IP address. After x attempts just add y seconds before allowing another login attempt. If you like, lock account with SMS or email to owner after z attempts. Do this per login, regardless of device type/location. The time taken to test out just 5 passwords should make a brute force impractical.
- wyck 13y agoThis plugin does exactly that and is very effective. Everyone using WP should be using it. http://wordpress.org/plugins/limit-login-attempts/ http://wordpress.org/plugins/limit-login-attempts/
- Viper007Bond 13y agoI run this on my personal site to prevent drive-bys but it won't stop a determined hacker with many IPs. Here's a proper solution to secure your account: http://wordpress.org/plugins/google-authenticator/ http://wordpress.org/plugins/google-authenticator/
- Viper007Bond 13y agoThat sounds not fun for the account owner. I could prevent you from logging into your account.
- barsxl 13y agoWordPress.com has pretty sophisticated brute force detection mechanisms and protections in place. I am not sure why you would say otherwise.