More than 70% of WordPress installations are vulnerable to hacker attacks.via Statistics Show Why WordPress is a Popular Hacker Target
These attacks come in a number of forms some of which include DDoS (Distributed Denial of Service) attacks, to Brute Force, and more recently SEO Spam attacks.
Let’s examine these further…
1. DDoS Attack
A DDoS or Distributed Denial of Service is when a perpetrator uses a botnet to flood a server with requests. This overloads the server resulting in an inability to respond making your site inaccessible.
The perpetrator or hacker does this by recruiting tons of bots that it then uses to attack your site. Essentially infecting vulnerable computers with malware. Once the malware is activated it provides a point whereby the hacker is able to have access into that computer giving it commands at will.
The botnet then receives a directive from the hacker with the details of the site that is to be attacked. This coordinated and timed event is referred to as a DDoS attack.
Such attacks can have a huge impact on businesses from financial to hindering reputation. The downtime alone can be crippling to any business regardless of size.
PC Magazine reported just a few days ago that CodeSpaces.com “closed its doors this week” due to the outcome of a DDoS attack. An extortion attempt was made.
When the team fought back, the hacker deleted “most of our data, backups, machine configurations and offsite backups,” the company said.via DDoS Attack Puts Code Spaces Out of Business
DDoS attacks are on the rise and changing.
Joel Locsin from GMA News says, “As we all have seen that DDoS trend is changing and to perform massive DDoS attacks, hackers are using every tantrum by leveraging the weakness of system applications to compromise them in order to boost the size of their botnet network”. via DNS flood DDoS attack hits video gaming site
2. Brute Force Attack
Brute force attacks are probably the most well known and common type of attack. They consist of a hacker attempting to gain access into a site via the password.
In a brute force attack, automated software is used to generate a large number of consecutive guesses as to the value of the desired data.via Brute Force Attack
Those who do not change their default username or have simple passwords are at the greatest risk.
A brute force attack can actually mimic a DDoS attack and cripple your server.
040Hosting reported, “such an attack has also an impact on the system resources, when an attack comes from another infected server and multiple of these infected sites are going to target your site together it actually works a bit like a ddos ; because all resources of your account get used and your account will be slowed down, with very large attacks it might even affect server performance in general’. via Joomla and WordPress Brute Force attacks – 040Hosting
The best way to prevent this type of attack is by installing a script on your website that will ban the IP of a failed login. SecureScanPro has this script built in and gives you control over how you want this dealt with. For example, you can determine how many attempts will result in a ban and for the length of time.
3. SEO Spam Attack
An SEO spam attack is whereby the hacker injects spam directly into the sites core installation directory.
Daniel Cid at Sucuri has been tracking and analyzing these types of attacks.
He says “thousands of compromised WordPress websites are being used to hide fake stores and spam doorways. In every case, the attacker is leveraging one of the core install directories – wp-includes”.via SPAM Hack Targets WordPress Core Install Directories
They identified that this type of spam injection has 3 common characteristics:
- The SPAM pages are hidden inside a random directory inside wp-includes (eg: /wp-includes/finance/paydayloan or /wp-includes/werty/)
- The spam is conditional and often based on the referrer
- We’ve noticed that, in almost every instance, the websites are running outdated WordPress installs or cPanel – this is obviously conjecture via SPAM Hack Targets WordPress Core Install Directories
WordPress Vulnerabilities Are On The Rise
In 2012 more than 117,000 WordPress installations were hacked via than 70% of WordPress installations are vulnerable to hacker attacks.
This means that 73.2% of the most popular WordPress installations are vulnerable to vulnerabilities which can be detected using free automated tools.via Statistics Show Why WordPress is a Popular Hacker Target
With continued reports in the news it seems that these numbers are only rising. Thus, it is imperative that we take action to protect ourselves.
What Should I Do To Prevent An Attack
Brandon Gaille, from WPVirtuoso recommends the following steps as a way of prevent hackers:
• Install a security plugin
• Use a PC that is free from malware and viruses
• Ensure your WordPress blog is up to date
• Use strong passwords
• Use reputable hosting companies
• Don’t use themes from a source that is not trustworthy
• Backup your blogs on a regular basis.via NUMBER OF WORDPRESS BLOGS HACKED EACH YEAR
Is your site secure? Have you done all that you can to protect your investment? Take the precautions needed today to ensure that you are not a part of these types of statistics.
