homepage Welcome to WebmasterWorld Guest from 54.243.13.30
register, free tools, login, search, subscribe, help, library, announcements, recent posts, open posts,
Pubcon Website
Home / Forums Index / Code, Content, and Presentation / WordPress
Forum Library, Charter, Moderators: lorax & rogerd

WordPress Forum

    
Attempted hack
travelin cat




msg:4642709
 4:56 pm on Feb 5, 2014 (gmt 0)

Yesterday someone tried to get into a clients Wordpress install using my username, Better WP Security blocked them but they somehow had my username which I NEVER give to anyone. This particular one was 12 characters long with numerals, capital letters and lowercase letters. They got the info correct, but the last two letters were lowercase instead of uppercase.

The IP said they were in South Korea. Any idea how this could happen?

 

mrblond




msg:4642714
 5:04 pm on Feb 5, 2014 (gmt 0)

Scary stuff.

I use the Login Page Rename plugin, so they'd need to know the name of /wp-login.php to get there.

These hackers are unbelievably amazing sometimes.

lorax




msg:4642751
 6:32 pm on Feb 5, 2014 (gmt 0)

Likely via another site on the same server but just in case - any outdated plugins or themes on the site?

travelin cat




msg:4642805
 8:58 pm on Feb 5, 2014 (gmt 0)

Nope. Everything is up to date.

lorax




msg:4642814
 9:23 pm on Feb 5, 2014 (gmt 0)

The most likely reason is if code is out of date (how old is the theme and how much customization was done?). Other than this, if your plugins & core are up to date, then they came in another way. Not through WordPress.

travelin cat




msg:4642820
 10:08 pm on Feb 5, 2014 (gmt 0)

The theme is new and updated regularly. I made a child theme that has a lot of css customizing, but nothing else.

lorax




msg:4642861
 12:42 am on Feb 6, 2014 (gmt 0)

Another thought. Did you access the site from a public WiFi at any point in the past month or so?

travelin cat




msg:4642880
 1:45 am on Feb 6, 2014 (gmt 0)

Nope. I never use public wifi.

lorax




msg:4642997
 12:59 pm on Feb 6, 2014 (gmt 0)

How strong is your salt?

Passwords are hashed before being put into the database so I strongly suspect someone either had access to your passwords or got to your database through another route.

Does your client access the site via FTP? Have they given access to anyone else for any reason? Do the site have any plugins from new or sketchy authors?

smallcompany




msg:4643035
 4:50 pm on Feb 6, 2014 (gmt 0)

Any idea how this could happen?


It happened to me in the past that my "hand picked" admin user name was used like in your case.
It turned that the picture gallery plugin would make my user name available whenever I would upload a photo into the gallery. The user name itself would not be published to be seen via a browser online, but it would be available within the HTML code.

I figured it by searching the database for the user name to see where it was actually showing up. That helped.

travelin cat




msg:4643058
 6:39 pm on Feb 6, 2014 (gmt 0)

Lorax, I'm the only one that has FTP access and the plugins are all tried and true ones like Yoast SEO and Better WP Security (which blocked the attack).

smallcompany, there is no gallery, but I will go through all of the page's source code to see if I can find something.

travelin cat




msg:4643063
 6:52 pm on Feb 6, 2014 (gmt 0)

I found it! This was in the initial post's source code I made for the client: <p class="meta-info"> By <a href="http://example.com/author/username/" title="Posts by company name" rel="author">

Any idea how to remove the meta info?

travelin cat




msg:4643069
 7:26 pm on Feb 6, 2014 (gmt 0)

My theme had a setting to remove the author data, so now it's gone. Phew. What a pain in the butt.

lorax




msg:4643161
 2:31 am on Feb 7, 2014 (gmt 0)

Glad you got it sorted!

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / WordPress
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About
© Webmaster World 1996-2014 all rights reserved