I don’t know what it is with certain individuals always trying to gain unauthorized access to a site. I understand the motivations of some, such as political activists gaining control and/or defacing their target site, but to just go around trying to gain access to sites randomly is beyond me. Rarely a day goes by that at least one attack isn’t attempted on this site. The vast majority of these are automated and easily thwarted. Others, however, are more determined and extremely annoying. Some are fairly clever while others amaze me with the trail they leave that makes it easy work to find where the attacks are coming from. I now always report these to their ISP. Others use methods that make them harder to find, such as Tor, but even Tor isn’t foolproof as it is rather easy to find their (many) exit nodes and blacklist them so they cannot even connect to your site (if you host your own site or if your hosting provider provides you with an IP deny tool, which they should). There have been several cases where I have blocked a single IP only to find that the attackers simply use another IP within that range… so I block the entire IP range. In one case, they kept coming, all from the same country. I finally had to block every IP range in that country which greatly increased the size of my deny list, but it stopped the attacks from that area completely.
Blocking entire IP ranges (or countries) definitely has it’s downside since it not only blocks the attackers, but also people simply interested in visiting your site. It’s a drastic measure, but one I feel I have to take to keep the site safe. Here are a few tips on how to keep your site safe. I won’t disclose the particular names and versions I use (for security reasons) but you can find the same or similar easily. Since I am using WordPress as my platform, some of this will be specifically for WordPress deployments.
Limit login attempts.
Allowing infinite attempts is like inviting disaster. Eventually your credentials will be compromised, especially if the attacker is using a powerful service like a cloud that allows them to throw truly amazing amounts of combinations per second at your site. You should be able to set how many login attempts before lockout and how long the lockout lasts. I personally allow only one try. If that try fails the attacker is locked out for a time that I have set and I am notified via email that an attempt was made. I then use whois to find information on the IP that the attack came from. I then report it to the abuse contact provided by the ISP.
Don’t use the default user name
This is, in my opinion, especially true of platforms such as WordPress and Joomla. In the case of WordPress, if you are already using the default username you can easily change it in your WordPress user database. Make it something unique and not the same as your “author” name.
Use strong passwords
I am constantly amazed at how many people use names or other easily cracked passwords such as words that can be found in any dictionary to protect their data. Never use a name, a word, or a number such as your birthday, phone or social security. These are easily cracked, even by a novice. An example of a strong password is to think of a sentence and then use the first letter of each word in that sentence, being sure to alternate upper and lower case. Also throw in special characters and numbers. For example, the sentence, “I use a Sony laptop seven days a week” would be IuASl7daW. Notice that I replaced “seven” with “7”. Throw in some special characters at the beginning and end and you have then have #@! IuASl7daW!@#. That’s a pretty strong password. It’s in no dictionary, and seems completely random. The longer, the better. One of my passwords is over 25 characters long. It may seem like this sort of password would be hard to remember but it’s not. Just remember the sentence. Once you have used it a while it becomes second nature, which leads to the next step in security.
Change your passwords at least fairly frequently.
Again, for security reasons, I won’t disclose how often I change my passwords. Changing them frequently helps keep you secure in the case someone has been working at gaining access to your site and have gleaned at least part of your password. Changing the password makes them start all over again. Also, don’t use the same password for all your accounts. Doing so can be disastrous because if you use the same password for each account, then once it is compromised it is like a master key to your entire online life.
Block repeat offenders
If you notice that a particular IP is repeatedly taking whacks at your site, block them. They obviously have no interest in your site other than to cause you trouble so blocking them is no loss to you. I both report and block them.
The bottom line is that most would-be attackers out there really have no skills at all. They use automated scripts and only succeed in gaining access to poorly protected sites. However, there are some individuals and groups out there that are very talented. The sad news is that there is no way to make a site completely bullet-proof, but you can sure make it very, very difficult to gain access to your site. But if one of those really talented individuals or groups really wants to get in your site, they will probably will. So back up frequently just in case!
Namu Amida Butsu
)
