Researchers at Defiant Threat Intelligence Team have identified a brute force attack campaign on WordPress sites. There have been four command and control (C2) servers identified, over 14,000 proxy servers from best-proxies.ru, and over 20,000 infected WordPress sites. The attacks make XML-RPC authentication attempts against accounts. XML-RPC authentication is used for network services that require security but do not require callers to identify themselves. It is often used in the APIs for mobile app developers to allow their apps to post to WordPress. As such, the apps usually store credentials locally which makes failed credentials fairly uncommon. The high rate of failure caught the researcher’s attention and revealed the campaign.
The plan of this attack contains three steps: create a list of credentials using dynamic wordlist generation, lean on multicall vulnerability to attack on scale, and try to cover its tracks with proxy servers between C2 servers and infected sites. The credentials begin with common passwords along with passwords generated from the list of usernames. Examples given in their report include the domain name, the username, and the username with common values appended to the end. Their example is an attack on example.com with the user name alice, the attack would use example, alice, alice1, alice2, alice2015, alice2016, alice2017, alice2018, and so forth. The attack also relied on the multicall functionality of XML-RPC authentication, the ability to send multiple username and password pairs at once and receive a list of successes and failures. This would allow the attack to make significant initial gains on progress but is limited to attacks on WordPress versions 4.3 and older.
Version 4.4 had since patched this issue and will return failures on any further attempts if the initial attempt is a failure. It is currently on version 4.9.8, but many users are still vulnerable to the multicall attack vector because they have not updated.
Finally, the attacker tries to cover their tracks by using proxy servers to anonymize the control between the attacker and the infected sites. The researchers at Defiant found a word list regeneration script that included a path argument that contained an IP address. The IP address brought the researchers to a login page on a server, which they easily uncovered as one of the C2 servers. They found four different servers which were poorly guarded. The researchers are currently working alongside law enforcement to remedy the attacks and reach out to the victims to alleviate the attacks.
The best defense against such brute force attacks would be to use long randomly generated passwords and updating your services to the latest versions.
Sources:
• https://www.wordfence.com/blog/2018/12/wordpress-botnet-attackingwordpress/
• https://threatpost.com/infected-wordpress-sites-are-attacking-otherwordpress-sites/139666/12