{"id":3166,"date":"2013-08-12T10:00:51","date_gmt":"2013-08-12T14:00:51","guid":{"rendered":"http:\/\/blog.nccomputertech.com\/?p=3166"},"modified":"2013-08-12T10:00:51","modified_gmt":"2013-08-12T14:00:51","slug":"password-thieves-target-blogs-content-management-sites","status":"publish","type":"post","link":"https:\/\/nccomputertech.com\/techtalk\/2013\/08\/12\/password-thieves-target-blogs-content-management-sites\/","title":{"rendered":"Password thieves target blogs, content management sites"},"content":{"rendered":"

\"\"<\/a><\/p>\n

Brute force attacks to pry login credentials from content management sites like blogs have been growing as more data robbers use a short-term gain for a bigger payoff later on.
\nSuch sites are attractive targets because they tend to be less secure than other environments\u2014such as financial services\u2014and since they’re interactive by design, “drive-by” malware planted on them can infect a lot of users quickly, said David Britton, vice president of industry solutions at 41st Parameter.
\n“With these types of interactive sites being compromised, we see more evidence of the developing attack trend that is focusing less on direct financial gain and more on gathering more detailed personal data, allowing fraudsters to build much more complex social engineering attacks that result in an eventual larger payoff,” he said via email.
\nMore and more attackers are realizing that websites built on CMS platforms, like WordPress, are ripe for password picking. “This marks a sea change in attackers targeting the low-hanging fruit of these blog systems,” Matt Bing, a research analyst with Arbor Networks, said in an interview.
\nOne such brute force campaign was identified last week by Bing. Dubbed “Disco Fort” by the researcher, it’s using 25,000 infected Windows machines to support attacks on more than 6000 Joomla, WordPress, and Datalife Engine sites.
\nEasy passwords, easy pickings
\nWhat attackers are finding is that login credentials for many sites running popular CMS systems are easy to steal. “The common passwords that were used to successfully compromise sites were nothing very sophisticated,” Bing said.
\nOf the more than 6000 sites compromised by the campaign, the top ten passwords used to crack them were “admin,” “123456,” “123123,” 12345,” {domain}, “pass,” “123456789,” “1234 150,” “abc123” and “123321.”
\nBrute force may be overstating what campaigns like Disco Fort are doing, since performing billions of computations in order crack these sites’ passwords isn’t in the attackers’ game plan. In fact, they can crack many of these sites with very few CPU cycles.<\/p>\n

\"\"<\/a><\/p>\n

“You can find files on the Internet of the 100,000 most commonly used passwords that can crack more than 95 percent of accounts,” Girish Wadhwani, a product manager at Nok Nok Labs, said in an interview.
\nOnce Disco Fort compromises a site, it places “backdoor” software on it so its operator can upload and download files and execute commands.
\nIn a number of cases, the attacker installed tools that could be used to activate a drive-by exploit kit. However, no evidence was found that the tools were ever used.
\nHow the attacker is recruiting PCs for a botnet army is also a mystery at this point. “The best evidence we have is that social engineering is being used,” Bing said. “We found an executable that was the name of a book in Russian\u2014Michael Lewis’ “The Big Short: Inside The Doomsday Machine”\u2014so it may have been trying to use that to trick users into installing the malware.”
\nShared vulnerabilities targeted
\nThe widespread use of off-the-shelf CMS systems has attracted attackers’ attention because if they have an unknown vulnerability for one of them in their pocket, it can be used to compromise many websites.
\n“Hackers are always looking to get the most profit for the least work,” Barry Shteiman, a senior security strategist at Imperva, said an interview. “With these CMS systems, they can do their work once and then hack many, many sites.”
\nMany of CMS systems, like WordPress, are easy to use. That’s a good thing for users, but it’s not so good for site security. “The biggest issue with WordPress is that its users are not always the most technically savvy,” Michael Sutton, vice president of security research at Zscaler, said in an email.
\n“WordPress is designed to be fairly easy and straightforward to install,” he continued, “so security is an afterthought for many of its users.”
\nIn addition, many bloggers and other CMS users aren’t concerned about someone breaking into their Web locale because they believe they don’t have anything worth stealing. That may be true, but it doesn’t mean they don’t have something valuable to hackers.
\n“What they don’t realize is that hacking into a website has become all about distributing malware,” Marc Gaffan, founder of Incapsula, said in an interview. “If you have a lot of people coming to your website, it’s a great place to infect your visitors.”
\nvia Password thieves target blogs, content management sites | PCWorld<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Brute force attacks to pry login credentials from content management sites like blogs have been growing as more data robbers […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[7,8],"tags":[453,797],"class_list":["post-3166","post","type-post","status-publish","format-standard","hentry","category-security","category-social-media","tag-hackers","tag-passwords"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/papNkV-P4","jetpack-related-posts":[{"id":9804,"url":"https:\/\/nccomputertech.com\/techtalk\/2024\/11\/08\/maximum-iceland-scenario-data-caps-3rd-party-android-stores-nuclear-amazon\/","url_meta":{"origin":3166,"position":0},"title":"Maximum Iceland Scenario – Data Caps, 3rd Party Android Stores, Nuclear Amazon","author":"NCCT","date":"November 8, 2024","format":false,"excerpt":"https:\/\/youtu.be\/P5MkCwktKz0 Data Caps, 3rd Party Android Stores, Nuclear Amazon \u2022 Google must crack open Android for third-party stores, rules Epic judge \u2022 Google asks 9th Circuit for emergency stay, says Epic ruling \u2018is dangerous\u2019 \u2022 Canceling subscriptions is about to get easier \u2022 The FCC is looking into the impact\u2026","rel":"","context":"In "Software"","block_context":{"text":"Software","link":"https:\/\/nccomputertech.com\/techtalk\/category\/software\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/P5MkCwktKz0\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9343,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/05\/27\/this-week-in-tech-668-how-many-cups-in-a-stone\/","url_meta":{"origin":3166,"position":1},"title":"This Week in Tech 668: How Many Cups in a Stone?","author":"NCCT","date":"May 27, 2018","format":false,"excerpt":"https:\/\/youtu.be\/i1oqaFyVcQ0 --The FBI wants you to reboot your router right now. FBI agents have gained control of a huge Russian botnet. If your router is affected you just need to reboot it. --Facebook and Russian ads - how should government react in the age of cyber warfare? --Amazon sells facial\u2026","rel":"","context":"In "Security"","block_context":{"text":"Security","link":"https:\/\/nccomputertech.com\/techtalk\/category\/security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/i1oqaFyVcQ0\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9374,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/07\/08\/this-week-in-tech-674-go-dung-beetles\/","url_meta":{"origin":3166,"position":2},"title":"This Week in Tech 674: Go Dung Beetles!","author":"NCCT","date":"July 8, 2018","format":false,"excerpt":"https:\/\/youtu.be\/AUy6JMi1pRw Survival of the Richest, Failing Facial Recognition Tech, \/r\/thanosdidnothingwrong, and More! -- Billionaires prepare for the coming apocalypse: have you bought your missile silo condo yet? -- London police's facial recognition fail: pilot program results in 98% false positive rate, zero arrests. --Amazon expanding its cashierless Amazon Go stores.\u2026","rel":"","context":"In "Technology"","block_context":{"text":"Technology","link":"https:\/\/nccomputertech.com\/techtalk\/category\/technology\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/AUy6JMi1pRw\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9309,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/03\/18\/this-week-in-tech-658-the-matador-defense\/","url_meta":{"origin":3166,"position":3},"title":"This Week in Tech 658: The Matador Defense","author":"NCCT","date":"March 18, 2018","format":false,"excerpt":"https:\/\/youtu.be\/ZLvZn_xEil0 Controversial RyzenFall AMD flaws revealed. Leo gives up Facebook for good over Cambridge Analytica scandal. Broadcom gives up its Qualcomm takeover. Apple announces an education-themed event on March 27th. Farewell Adrian Lamo. Theranos officially charged with fraud. Bitcoin mining will drain the world's energy.","rel":"","context":"In "Apple"","block_context":{"text":"Apple","link":"https:\/\/nccomputertech.com\/techtalk\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/ZLvZn_xEil0\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9337,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/05\/06\/this-week-in-tech-665-konnichihuahua\/","url_meta":{"origin":3166,"position":4},"title":"This Week in Tech 665: Konnichihuahua","author":"NCCT","date":"May 6, 2018","format":false,"excerpt":"https:\/\/youtu.be\/DkivlhEOks8 Apple has its best Q2 ever, despite analyst predictions. 20 years of iMac. Cambridge Analytica must give US voter his data. Unroll.me foiled by GDPR. NPR buys PocketCasts. Change your Twitter password. Sprint\/T-Mobile merger. Net Neutrality vote in the Senate May 9th. Cyber Command gets a promotion.","rel":"","context":"In "Apple"","block_context":{"text":"Apple","link":"https:\/\/nccomputertech.com\/techtalk\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/DkivlhEOks8\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9397,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/09\/02\/i-speak-for-the-bezels-this-week-in-tech-682\/","url_meta":{"origin":3166,"position":5},"title":"I Speak for the Bezels – This Week in Tech 682","author":"NCCT","date":"September 2, 2018","format":false,"excerpt":"https:\/\/youtu.be\/kVcihaMWLmA This Week in Tech iPhone XS, Pixel 3, Trump vs Google, and more Leo is on vacation, so Jason Snell is guest hosting! Apple's next big event is September 12th, and we have a sneak peek at the new iPhone XS and Apple Watch Series 4. The iPhone XS\u2026","rel":"","context":"In "Apple"","block_context":{"text":"Apple","link":"https:\/\/nccomputertech.com\/techtalk\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/kVcihaMWLmA\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/posts\/3166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/comments?post=3166"}],"version-history":[{"count":0,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/posts\/3166\/revisions"}],"wp:attachment":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/media?parent=3166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/categories?post=3166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/tags?post=3166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}