WordPress Brute-Force Amplification and How to Protect your Site
Although WordPress has so far been most vulnerable through certain plugins of suspicious quality, new findings from Sucuri show that currently the biggest threat to the most popular CMS platforms, including WordPress and Drupal, is coming from Brute Force Amplification attacks.
Namely, it seems the WordPress xmlrpc.php file has yet again become the target of severe security breaches last week, which caused much noise in the communities of webmasters worldwide. This time, however, protecting your webpage is rather easy. But we’ll get to that later on.
First, let us see what XML-RPC really is and what it does.
What is XML-RPC?
XML-RPC, or xmlrpc.php file, is actually one of the simplest protocols for securely exchanging data between computers across the cyber world (securely being the key word here, right?). Jokes aside, the trick is that XML-RPC uses the system.multicall method that allows an application to execute multiple commands with only one HTTP request. This way XML-RPC enables remote platforms to interact with one another online, which basically means this WordPress xmlrpc.php file enables external applications to connect, transmit, and process data.
Now that you probably skimmed through all these technicalities, let’s see what exactly is going on with this new type of hacks.
Amplified Brute-Force Attacks
A “normal” or typical brute force attack includes machines which are trying to guess the username and password for a certain webpage and they do it one at a time. However, in an amplified brute force attack, the hackers are capable of guessing hundreds or thousands of combinations within a single request. This makes their breaching attempts all the more efficient and renders the protection equally difficult. When it comes to the XML-RPC protocol within WordPress, it is basically a communications bridge between a remote application (think WordPress mobile app, for instance) and the site itself. This is exactly where “the magic” happens. Which brings us to our next section:
How to Protect your Site
Perhaps the simplest and most practical way to protect your WP page from these malicious attacks is to use .htaccess to block hackers’ access to xmlrpc.php altogether. This is an easy-to-do solution that is at the same time thorough, reliable, and maintenance-free. Simply block xmlrpc.php via Order/Deny by typing in:
# protect xmlrpc
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>
The great thing with .htaccess protection is that you can customize it in a way that you are able to selectively allow or deny access from specific IP addresses. You can also redirect all the blocked requests to a specific page. Pretty cool. However, if this is too much of a bother for your style, you can always get a suitable WP plugin and be done with it.
Jetpack Protect Plugin
Jetpack has a great module called Jetpack Protect (formerly known as BruteProtect), that does what it does best – protects sites from brute force attacks. Even Sam Hotchkiss, the main man of Jetpack Protect himself, officially confirmed via recent WordPress post that Jetpack Protect users are safe from brute force amplification attacks. What proof do you need more?
Now that you learned how to stay protected from these newest security breaches, maybe you’d like to check out these cool WordPress Layout and Styling Tips. It is never too late or too early to make your page look stylish.
