2014 Brute Force Attack against WordPress

2014 Brute Force Attack against WordPress

Hello all, I hope this post finds you well.

This is a Warning Post to ALL WordPress users!

Wordfence, maker of the WordPress security plugin, recently announced that yet another broad spectrum Brute Force Attack against WordPress users happened but at a scale not seen before. The massive attack happened on February 10th, 2014 at approximately 11:00am.

The company is recommending to all of its plugin users to make sure their products are updated to the latest versions. This is however not just an issue for Wordfence users, but serves as a notice to those who don't use a Wordfence product or any product for that matter to secure their WordPress website or Blog. Be aware that such attacks occur and be sure to have unique user names and passwords in place to help protect your site as well as some type of security measures activated either with your host or on your site via plugins, etc.

A Brute Force attack uses computers to make hundreds, even thousands of login attempts to your WordPress website, sometimes these guessing games are successful in figuring out a persons log in information. Most users of WordPress don't realize that every installation of WordPress gets the same user name, "admin". It is highly recommended to change that as well as the password, if the default user name of "admin" is left in place, thats half the battle won for the hackers if they already know that every installation comes with the user name "admin".

In addition, try not to use your browser to remember your passwords and personal information. This information could be compromised and used to access your personal information. Also remember to empty your temporary Internet files and cache when exiting your Internet session. Most browsers have settings that allow you to empty the trash and temp files on exit, this is highly recommended. Also, only trust third party cookies from companies or websites you use and trust, these cookies are usually not rated and could present a risk.

In the end, theres not much we can do if a hacker wants to get in. All we can do is our best to stay informed and united against the trouble it causes for the average user who has no political agenda or impact on a particular community or cause. Its the everyday user who has to suffer from the inconvenience and often hefty expense of being hacked or compromised. This post is just a meager attempt to spread the word about the latest Brute force attack and to remind WordPress users to stay on guard!

By
Allan Whitney
Owner/Administrator
MindVisionMedia.net

New Penguin 2.0 search alogorithm changes coming!

Google is preparing to launch its new search algorithm, Penguin 2.0 that could possibly effect your websites listing and standing with Google. The new algorithm increases spam and malware detection on hacked websites and is expected to launch in summer 2013. These changes are related to security and cracking down on both malicious and vulnerable sites.

If your site is or has been hacked, you could be blacklisted by Google search. However there are new tools built in to help you repair and restore your site to good standing as you will read below. If your site is identified as a spam or malware distribution site, it will be banned. Personally I think it is a good thing with all of the trickery taking place on the Internet these days.

According to Wordfence, Matt Cutts, head of the Google Web Spam team and SEO spokesman, has posted a preview of what is coming in the Penguin 2.0 release, due Summer 2013. Penguin 2.0 is the next major update of Google's search algorithm and it's associated tools and applications.

The changes coming in Penguin 2.0 update related to security are:

• Improved detection of hacked websites. This probably means your site is more likely to be blacklisted by Google when you are hacked and that it will be blacklisted sooner. 
• Improved communication with webmasters when your site is hacked. Currently if you sign into Google Webmaster Tools, you can select to receive a daily digest of issues related to your websites. My guess is that Google is expanding this to offer real-time email alerts when malware is detected on your site or when your site is compromised. 
• A possible differentiation between sites that are hacked and sites that serve up malware. 
• Better tools to diagnose and clean your hacked website. Matt describes a single place you can go to once your site has been hacked where you can get more information that will help you clean up your site. 
• Webmaster Tools will be providing more concrete details and "example URLs" that you can go to to diagnose your site. [No specifics on this]

Other interesting changes related to SEO are:

• Google will still give preference to high quality content that "users love, bookmark, come back to and visit over and over again". It sounds like repeat visitors may get a higher emphasis with the Penguin 2.0 update. 
• They will penalize paid links and paid websites that attempt to boost the ranking of other websites by linking to those other websites. They will be removing any Page Rank that those paid sites pass on to the sites they're trying to promote. 
• They are making two algorithm changes that will significantly affect the ranking of sites in sectors that are particularly spammy. 
• Penguin 2.0 will do a better job of giving sites who are clearly an authority in their space a higher ranking. 
• They will also attempt to soften penalties that were imposed on some sites with the release of Penguin 1.0. Specifically sites that are in a gray area but have some positive signals will see a higher ranking.

WordPress is particularly vulnerable because of its dynamic nature so this would be a good time to examine your sites vulnerability and increase your awareness of security issues and measures as I have to ensure your site is not effected. Always keep your login name and passwords strong and button down the hatches by not leaving old or outdated plugins and themes to remain inside your sites directory. Also monitor your posts and install malware detection on your site or server. Check with your web host to see what they can offer to protect you as well.

All we can do is cross our fingers and hope for the best. After-all, we are all targets of spam and malware so the battle will continue. lets stick together on this one and keep each other informed. Best of luck to all.

By
Allan Whitney
Owner/Administrator
MindVisionMedia.net