Getting Attempted Hacks – Can't Figure Out How/Why!

  • Resolved The Tshirt Guy

    (@ksteinmann)


    10 years, 4 months ago

    I’m one of the most ardent fans of this plugin, I think. I believe it is AWESOME, and I don’t hesitate to tell people so. However, I’m seeing something new that concerns me.

    A few weeks back, I noticed that we were getting regular hack attempts, despite the fact that we were using the same set of features on AIO that had worked flawlessly for a long time. The only major thing that we weren’t doing was was using a unique login url. So, we went to that.

    The hack attempts seem to stop… until a few days ago. Then, all of a sudden, they were back again. It’s probably a bot, as the attempts are regular and fall outside the lockout window. So far, they’re just attempting to use “admin.” This, of course, is fruitless, since nobody using AIO would use “admin” as an ID. Anyway…

    Is it possible AIO (or WP itself) is somehow “leaking” the secret URL? The reason I ask is because we no sooner changed the secret login URL again last night, than within hours we were getting the same kind of hack attempts.

    Here’s a screenshot: https://www.dropbox.com/s/r7zgf0d4rvgwype/Voila_Capture%202014-11-02_03-28-07_PM.png?dl=0

    I could use some help, guidance, suggestions, etc.

    Thank you!

    — Karl

    https://www.ads-software.com/plugins/all-in-one-wp-security-and-firewall/

Viewing 10 replies - 1 through 10 (of 10 total)
  • Plugin Contributor mbrsolution

    (@mbrsolution)

    Hi Karl,

    Have you enabled the following features?

    If you have a static IP address and you are the only one that logs into your website, you could Whitelist your IP address and or those who login in. But remember once you add any IP address to the Whitelist, those will be the only IP addresses that will be able to log into your website.

    Also try enabling ping back protection if you haven’t done so yet.

    Regards

    Plugin Contributor wpsolutions

    (@wpsolutions)

    Hi Karl,
    I think that your secret URL is NOT being compromised.
    The lockouts you are seeing are most probably caused by bots sending xml/rpc requests to your site. Within those requests they are including a username of “admin” together with a password.

    As mbrsolution has stated, you should enable the “pingback protection” feature which should stop these xml/rpc requests from bombarding your site.

    Thread Starter The Tshirt Guy

    (@ksteinmann)

    mbrsolution & wpsolutions – thanks for the prompt feedback and advice!

    It sounds like you have hit the nail on the head. I was allowing pingbacks and had no idea this could be causing the issue at hand. I’ve now implemented the pingback protection.

    I am greatly relieved to know that there is no “leakage” happening here! And… I learned something new today about WP security I did not know. Even better.

    If there are any further concerns, I will get back to you. If not, assume you have answered my question and solved the issue.

    Thanks again. Much!!! ??

    Plugin Contributor mbrsolution

    (@mbrsolution)

    Hi KSteinmann that is great news ??

    You may mark this support thread as resolved if you don’t need any further assistant.

    Thank you

    Thread Starter The Tshirt Guy

    (@ksteinmann)

    I think that did it, guys!

    No more hack attempts since I set the pingback protection.

    I really, really appreciate the fast help and support. I was mystified. It’s great to know you guys are on the ball!

    Rock on, and keep up the GREAT work!

    ??

    I’m getting the same types of hack attempts, repeated brute force attempts to log in as ‘admin’ from different IP’s on each attempt.

    The ‘prevent pingbacks’ function is/has been active this entire time. So, apparently it’s not blocking the xml/rpc attacks you mentioned.

    Since ‘admin’ doesn’t exist we haven’t had to worry. But, it does give us the feeling that they have found our login form which should be ‘cloaked’ with the custom URL provision in AIO.

    I’m having the same problem and I do have “prevent ping backs” active. In fact, the only site I run that isn’t being attacked is the only one that I don’t use this plugin on. It’s also the only site that I have installed in a subfolder of the domain; i.e.: https://www.domainname.com/wordpress/

    In fact, I have never had any problems with this site getting hack attempts. Could the fact I installed it in a subfolder called “wordpress” be the reason it’s not getting attacked?

    Plugin Contributor wpsolutions

    (@wpsolutions)

    Hi @simco and @gdaniels99,
    Both of you say that you have the “pingback protection” enabled, so I want to confirm something.
    Can you please try a quick test:
    using a browser, enter your site’s url followed by “xmlrpc.php” and let me know what you see.
    Example:
    https://www.yoursite.com/xmlrpc.php

    I get the following message:

    XML-RPC server accepts POST requests only.

    Plugin Contributor mbrsolution

    (@mbrsolution)

    Hi @gary D please read the following thread. It might have the solution to your problem.

    Kind regards

Viewing 10 replies - 1 through 10 (of 10 total)
  • The topic ‘Getting Attempted Hacks – Can't Figure Out How/Why!’ is closed to new replies.

Tags