Recent new xmlrpc.php brute force password-guessing attack details

mod_sec rules – hope you know what you’re doing ??

SecRule<br />
REQUEST_LINE "POST .*wp-login.*"<br />
"pass,initcol:ip=%{REMOTE_ADDR},setvar:ip.maxlimit=+1,deprecatevar:ip.maxlimit=1/600,nolog,id:35011"<br />
SecRule<br />
IP:MAXLIMIT "@gt 10" "log,deny,id:350111,msg:'wp-bruteforce: denying<br />
%{REMOTE_ADDR} (%{ip.maxlimit} connection attempts)'"</p>
<p>SecRule<br />
REQUEST_LINE "POST .*xmlrpc.*"<br />
"pass,initcol:ip=%{REMOTE_ADDR},setvar:ip.maxlimit=+1,deprecatevar:ip.maxlimit=1/600,nolog,id:35012"<br />
SecRule<br />
IP:MAXLIMIT "@gt 2" "log,deny,id:350112,msg:'wp-bruteforce-xmlrpc:<br />
denying %{REMOTE_ADDR} (%{ip.maxlimit} connection attempts)'"

This also looks good, though I haven’t tried it yet
https://github.com/wp-plugins/ninjafirewall

Unfortunately for those of us who manage “humble and rather unaware” clients, this is not helpful

If you are managing “humble and rather unaware” clients, you are more than welcome to install a plugin which forces strong passwords for them. At the moment, forcing WordPress users to do anything of the sort really is of no interest to the core developers.

If you really feel like it should be, please feel free to file a report: https://codex.www.ads-software.com/Reporting_Bugs

TigerTech,

I am seeing the same brute force attacks, and it’s distributed on multiple ip’s. MacManX brings up valid points, but is not ideal for curbing DDoS brute forcer attacks.

Iamhere, that SecRule is only handy for wp-login.php…

https://github.com/n4sss/XmlRpcBrute/blob/master/wpXmlrpc.php

Hello, thread friends.

I’m seeing the same attacks, and now I feel safe after your information. I have strong passwords and try to follow the rules explained in Hardening WordPress article.

On the other side, I’m concerned about the bandwidth these attacks is sucking from my poor server. Is there a way to avoid it?

Thanks in advance.

Saúde!
m.

The only way to avoid (read:lessen) the loss of bandwidth from brute force attacks would be to limit the information that those attacks receive…. e.g. block/stop each attempt/attack as quickly as possible so each attempt is loading the smallest amount of data possible.

After that the only thing you can do is hope to deter any further attempts by showing that your defenses make your site too difficult to waste time on attacking.

I have noticed that on sites that had no extra security and were under attack, as I implement(ed) more security measures the attacks grew less frequent. Or at least my logs of attacks grow smaller, I have no evidence that attacks I am not aware of are happening or not.

All this leads me to believe that attackers are simply playing a numbers game; trying to hack the most amount of websites with the least amount of effort. If your site takes too much time/effort it has a fair chance of being passed up.

Joseph,

Thanks for your advice. I will try to keep my WP installations as secure as possible. ??

Saúde!
m.

Use .htaccess to block all requests made to xmlrpc.php

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from 123.123.123.123
</Files>

The allow line gives you opportunity to whitelist your ip(s) if you use WordPress app on your self hosted site.

I’ve actually blocked xmlrpc.php requests at apache… It’s just annoying.

Citation: via InMotionHosting https://www.inmotionhosting.com/support/website/wordpress/disable-xml-rpc-requests