Hackers have developed a distributed WordPress admin account cracking scheme that poses a severe risk for the security of blogs whose owners select insecure passwords.

PHP scripts located on a virtual server run bruteforce (password guessing) attacks on targeted sites. Many sites can be attacked at the same time by the system, with results written into an associated database.

The SANS Institute’s Internet Storm Centre notes that brute force attacks against WordPress are commonplace. The distributed nature of the latest attack marks an evolution towards blog hacking as a web service, however, thus marking it out from the crowd.

“While this particular version is relatively simple, the power behind the script and the MySQL database allows the attacker to distribute the attacks not only by sites, but also by passwords tried as well,” ISC security watcher Bojan Zdrnja writes.

Blog administrators are advised to use strong (hard to guess) passwords and to limiting access by IP address as a security precaution to prevent getting pwned.

Find the original article here.

According the latest Microsoft’s researches guessing FTP passwords is still a valuable way to harvest account information. People still forget or ignore to change their default password or change it that way attackers can easily guess.

Microsoft releases password attack data

Microsoft released data collected from an FTP-server honeypot, showing that attempts to guess passwords continue to focus on the low-hanging fruit: passwords with an average length of eight characters, with “password” and “123456″ being the most common.

The data is part of a project to monitor attacks that everyday users might encounter on a regular basis. Most of the attacks attempted to log into the administrator account on English and French computers — “Administrator” and “Administrateur” were, by far, the two most popular usernames — using a variety of passwords. The attackers were typically compromised computer that were part of a botnet, Microsoft researchers stated on the company’s Malware Protection Center blog.

“You should take care of what user name and password you’re choosing,” the researchers wrote. “If your account has no limit on the number of login attempts, then knowing the user name is like having half the job done.”

In one case, an attacker made more than 400,000 attempts to guess a user name password combination.

The most common passwords were password, 123456, #!comment:, changeme and an expletive.

Microsoft recommended that users create passwords consisting of letters, numbers and special characters using a combination of lower and upper case. The average length of the password attacks was eight characters, so users should focus on longer passwords, the researchers stated.

You find the original article here.