Strange attempted username hack

  • Resolved wpress2010

    (@wpress2010)


    5 years, 4 months ago

    I recently received a WordFence alert on one of our sites, the typical message, “A user with IP addr (apparently a Russian IP, but who knows…) has been locked out from signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 2. The last username they tried to sign in with was: (a “real” username, but all of the uppercase letters were lowercase).”

    This site has only one admin – myself, and one other admin user who has never signed in – the “emergency” user for administrative purposes. It’s a small, non-interactive “brochureware” business site with relatively little traffic. I always access it from our wired network, behind a firewall and with the usual antivirus/malware security on the browsers.

    Of course, I immediately deleted that admin user and set up a different one with a new username and password. All of the usernames and passwords we use are randomly generated, and do not contain anything that could be guessed.

    I’m wondering how this potential hacker got hold (almost) of a valid username, and how their method resulted in the username string’s letters being converted to all lowercase! AFAIK, WordPress does not allow any special characters to be used in usernames.

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Support wfpeter

    (@wfpeter)

    5 years, 4 months ago

    Hi @wpress2010, thanks for your question!

    It’s possible that they are obtaining your username by placing /?author=1 or /wp-json/wp/v2/users/1 at the end of your site URL.

    Can you go to Wordfence > All Options > Additional Options, and see if Prevent discovery of usernames through ‘/?author=N’ scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps is ticked?

    https://www.wordfence.com/help/firewall/brute-force/#prevent-username-discovery

    It may also be possible that an attacker obtained information about your domain name, such as your email address, and are using that information to guess your username.

    Thanks,

    Peter.

    Thread Starter wpress2010

    (@wpress2010)

    5 years, 4 months ago

    Hi, Peter. That box was checked in WordFence, as were all of the Additional Option boxes. The username in question was completely unguessable, as it was a random string of both uppercame and lowercase letters and numbers, no actual words, etc.

    A lot of failed attacks I see in our WordFence notification emails show hackers attempting to log on using the domain name itself (less the suffix) as a possible username. The one I reported on here was the first one I’ve ever seen that actually “almost” used a valid username. But then again, the passwords are all complex random things as well, so after a couple of “guesses,” the potential hacker is locked out – and typically hops to another fake IP to try again. If I see many attempts with the same bad username, I just add that to the block list.

    Plugin Support wfpeter

    (@wfpeter)

    5 years, 4 months ago

    Hi @wpress2010, that sounds like a good plan to monitor the situation.

    If the obscure username that was correctly guessed with that setting turned on has never made a post or some other action on the public side of your site that could be scraped from your HTML content served to the browser, it is harder to work out where that may have come from.

    You could send us a site diagnostic if you wish, so that I can discuss it further with our team? Send it to wftest @ wordfence . com, after finding the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    Thanks again,

    Peter.

    Thread Starter wpress2010

    (@wpress2010)

    5 years, 4 months ago

    Done. Thank you!

    Plugin Support wfpeter

    (@wfpeter)

    5 years, 4 months ago

    Hi @wpress2010,

    I’ve looked into your diagnostic report and can’t see any issues or settings that I feel we should be concerned about in terms of your site security around this. However there is some further information about usernames in WordPress that you should be aware of.

    ​WordPress to this day does not intend to hide your username and does not consider the intentional leaking of usernames to be a security problem. Instead their recommendation is to use strong passwords and two factor authentication to secure your login page, rather than hide your username. You can read more about this here:
    https://make.ww.wp.xz.cn/core/handbook/testing/reporting-security-vulnerabilities/#why-are-disclosures-of-usernames-or-user-ids-not-a-security-issue

    For example, Dion Hulse, a core contributor to WordPress, explained the reasoning behind leaked usernames:

    “It has been stated in previous tickets, ‘leaking’ of the username is not deemed a security issue by ww.wp.xz.cn, as it’s a conscious decision to use the username as the slug in the URL”

    The current stance on this is also evident in the WordPress Codex regarding “Access Control”:

    “One of the top two attack vectors used by cyber criminals is software vulnerabilities and access control. To combat this you must secure any point of entry into your host, WordPress installation or server. This includes employing strong passwords and enabling some form of Multi Factor Authentication.”

    Brute force login attacks are one of the most common attacks that we see and is normal. We see millions of brute force login attempts per hour on WordPress sites protected with Wordfence. Here is a blog post explaining why hackers are interested in your site and then steps you can take to keep your admin account protected: https://www.wordfence.com/blog/2018/03/ask-wordfence-why-is-an-insignificant-site-like-mine-being-attacked/

    To keep yourself protected please carry out the following if you haven’t already done so:

    1) Make sure all admin accounts and those with high level access. e.g. with publisher access, use a very strong password – WordPress can auto generate a very strong password for you on an account page. We recommend using a password manager such as 1password.com to store your complex passwords that are exceedingly difficult to remember.

    2) Set our recommended brute force protection rules. Instructions are in the link below. You can quickly find these options in the Brute Force Protection section on the All Options page: https://www.wordfence.com/help/firewall/brute-force/

    3) Enable two factor authentication for administrators and those with high level access e.g. with publisher access. This feature is on the Wordfence > Login Security page. Instructions are in this link: https://www.wordfence.com/help/tools/two-factor-authentication/

    4) If there are a large amount of login attempts for the same username coming from a large pool of IP addresses then you can also enable the Google reCAPTCHA feature found on the Wordfence > Login Security > Settings page. If you want to limit the number of email alerts that you receive then you can adjust the settings in the Email Alert Preferences section on the All Options page.

    Thanks,

    Peter.

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Strange attempted username hack’ is closed to new replies.