Funkcjonalność tej witryny będzie ograniczona w czasie konserwacji. Jeśli artykuł nie rozwiązuje twojego problemu i chcesz zadać pytanie, to nasza społeczność wsparcia jest dostępna na @FirefoxSupport na Twitterze i /r/firefox na Reddicie.

Avatar for Username

Przeszukaj pomoc

Unikaj oszustw związanych z pomocą.Nigdy nie będziemy prosić Cię o dzwonienie na numer telefonu, wysyłanie SMS-ów ani o udostępnianie danych osobowych. Zgłoś podejrzaną aktywność, korzystając z opcji „Zgłoś nadużycie”.

Więcej informacji

Wątek został zarchiwizowany. Jeśli potrzebujesz pomocy, zadaj nowe pytanie.

Wordpress attack from mozilla products

ahsteve
ahsteve
more options

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack.

example logs

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"

93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"

There should be some security hole in the product which is helping the hackers to do it.

Steve

I am from a hosting provider. For the past 4 days we are under attack. The logs says that its coming from a Mozilla product. The ips from the attack are world wide. We have seen over 90,000 IP addresses involved in this attack. example logs 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1" 93.142.203.126 - - [09/Apr/2013:13:50:26 -0400] "POST /wp-login.php HTTP/1.1" 200 3840 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17" There should be some security hole in the product which is helping the hackers to do it. Steve

Wszystkie odpowiedzi (2)

philipp
philipp
  • Moderator
more options

hello, the two example logs you've provided are from a (outdated) firefox 16.0.1 & a chrome 24 installation. the Mozilla/5.0 string in front of a user-agent is used for historical reasons by all browser vendors & doesn't mean that it is coming from a mozilla product.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Sounds like a botnet attack. I am not aware of any botnet attacks that run through browsers, although, with such an open add-on model, it may well have been tried. However, that would not be very stealthy... It seems more likely that the bots simply forged the user agent strings to avoid detection and blocking.

There are plugins to blunt brute force attacks by slowing down retries, such as: http://wordpress.org/extend/plugins/login-security-solution/

Edit: Based on support forum postings for version 0.35 of the above plugin, do not use its feature to force all users to reset all passwords immediately installing.

Zmodyfikowany przez jscher2000 - Support Volunteer w dniu