본 사이트는 여러분의 사용자 경험을 개선하기 위해 유지 보수를 진행하는 동안 기능이 제한됩니다. 도움말로 문제가 해결되지 않고 질문을 하고 싶다면 Twitter의 @FirefoxSupport 및 Reddit의 /r/firefox 채널을 활용하세요.

Avatar for Username

Mozilla 도움말 검색

고객 지원 사기를 피하세요. 저희는 여러분께 절대로 전화를 걸거나 문자를 보내거나 개인 정보를 공유하도록 요청하지 않습니다. "악용 사례 신고"옵션을 사용하여 의심스러운 활동을 신고해 주세요.

자세히 살펴보기

이 쓰레드는 보존되었습니다. 만약 도움이 필요하시면 새로운 질문을 올려주세요.

Wordpress attack from mozilla products

ahsteve
ahsteve
more options

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack.

example logs

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"

There should be some security hole in the product which is helping the hackers to do it.

Steve

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack. example logs 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1" 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17" There should be some security hole in the product which is helping the hackers to do it. Steve

모든 댓글 (2)

philipp
philipp
  • Moderator
more options

hello, the two example logs you've provided are from a (outdated) firefox 16.0.1 & a chrome 24 installation. the Mozilla/5.0 string in front of a user-agent is used for historical reasons by all browser vendors & doesn't mean that it is coming from a mozilla product.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Sounds like a botnet attack. I am not aware of any botnet attacks that run through browsers, although, with such an open add-on model, it may well have been tried. However, that would not be very stealthy... It seems more likely that the bots simply forged the user agent strings to avoid detection and blocking.

There are plugins to blunt brute force attacks by slowing down retries, such as: http://wordpress.org/extend/plugins/login-security-solution/

Edit: Based on support forum postings for version 0.35 of the above plugin, do not use its feature to force all users to reset all passwords immediately installing.

글쓴이 jscher2000 - Support Volunteer 수정일시