Cyber Attack wordpress-ddoS-attacks-2

Published on February 21st, 2016 | 27 views Post Views

Thousands of WordPress websites used as a platform to launch DDOS

In a recent investigation case, security researchers at Sucuri revealed that 26,000 different WordPress sites were exploited to launch Layer 7 distributed denial of service (DDoS) attacks.

In a recent investigation case, security researchers at Sucuri revealed that 26,000 different WordPress sites were generating a sustained rate of 10,000 to 11,000 HTTPS requests per second against one website, and sometimes even peaked at 20,000. The problem is that any WordPress website could be used to attack the availability of other websites if the pingback feature is enabled (its default setting).

The HTTP flood or Layer 7 attacks would inundate the web server with Layer 7 requests resulting in very large DDoS attacks and disrupt a server by exhausting its resources at the application layer and not at the network layer. They do not require as many requests or as much bandwidth to cause damage; they are able to force a large consumption of memory and CPU on most PHP applications, content management systems (CMS), and databases.

▼Advertisements

Founder and CTO of Sucuri, Daniel Cid recommends disabling pingbacks on your site. Although It won’t protect you from being attacked, but will stop your site from attacking others.

“The best course of action is to disable pingbacks and if possible, disable xmlrpc altogether if you are not using it. If you are, you can make some very small changes to your .htaccess file to allow only whitelisted IPs to access the file. This might be the case with the popular JetPack plugin.” He said.

wordpress ddoS attacks.jpg

Figure 1 Taken from http://www.tweaktown.com/

It has been known for years that the WordPress pingback service can be abused for DDoS attacks mainly because website owners rarely bother to prevent their site from being added to a botnet. Since the attack is coming from thousands of different IP’s, network-based firewalls will do little to stop the attacks as they only do rate limiting per IP address. The researchers discovered that the majority of IP addresses used in this attack were sites hosted on popular VPS/Cloud/Dedicated server providers: Amazon AWS, Digital Ocean, Google Cloud, Microsoft Azure, Hetzner, OVH and Linode.

▼Advertisements

The researchers discovered that the majority of IP addresses used in this attack were sites hosted on popular VPS/Cloud/Dedicated server providers: Amazon AWS, Digital Ocean, Google Cloud, Microsoft Azure, Hetzner, OVH and Linode.

wordpress ddoS attacks 2

References:

  1. https://blog.sucuri.net/iAKwLeEl.pngwordpress-sites-leveraged-in-ddos-campaigns.html?utm_campaign=WordPress%20Sites%20Leveraged%20in%20Layer%207%20DDoS%20Campaigns%20blogpost&utm_medium=social&utm_source=linkedin
  2. https://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html
  3. http://www.securityweek.com/wordpress-sites-used-power-layer-7-ddos-attacks?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Securityweek+%28SecurityWeek+RSS+Feed%29
    http://news.softpedia.com/news/26-000-wordpress-sites-leveraged-in-layer-7-ddos-attack-500552.shtml
  4. http://www.tweaktown.com/news/50500/26k-wordpress-sites-attacked-clever-layer-7-ddos-attack/index.html

 

Share on Facebook0Share on Google+0Tweet about this on TwitterShare on Reddit0Email this to someonePrint this pageShare on StumbleUpon0Digg thisPin on Pinterest0Share on LinkedIn1




One Response to Thousands of WordPress websites used as a platform to launch DDOS

  1. Pingback: Apache XSSF

Leave a Reply

Back to Top ↑

You Might Also Like:
NAXSI – Open-Source WAF For Nginx

NAXSI is an open-source WAF for Nginx (Web Application Firewall) which by default can block 99% of known patterns involved...

Close