If your company’s website ‘goes down’ for any reason, the loss of face and reputation can be long lasting for customers who can quickly become disenchanted by lack of service.
With this ‘reliance’ on website uptime in mind, some valuable lessons have been highlighted this month by the hack that occurred on the very popular open source web content management tool WordPress. The service was attacked and as hundreds of thousands of small to medium sized businesses (SMBs) use WordPress as the engine behind their web presence, the botnet behind this attack will have caused concern among many firms who have suffered from their websites being unavailable on both the front (user-facing) and back (company-facing) end.
A total of some 64 million websites are built using WordPress and an estimated 371 million people read content posted on this service in any one month.
The BBC News service this month reported that the botnet targets WordPress users with the username “admin”, trying thousands of possible passwords. Surprising though it may sound, many users still exist with the “admin” username left unchanged from the point of initial sign in, thus leaving themselves more susceptible to malware based attacks of this kind. Other users with more personalised usernames are also thought to have been affected.
The attack itself began a week after WordPress confirmed that it had improved its own security systems by introducing an (albeit it optional) two-step authentication log-in option.
According to instructions from WordPress itself, “When you log in to your WordPress.com account, we’ll prompt you to enter a secret number. To get that secret number, you’ll need to download the Google Authenticator App on your smartphone. It generates a new number every 30 seconds, making it virtually impossible to guess.”
Again turning to the BBC report, it appears that this attack was perpetrated by hackers using what was described as a “relatively weak” botnet constructed by a group connection of home PCs. This network was then engineered to build a much larger botnet of far more powerful connected servers that could spread the attack further.
Once again we come back to the very real threat this kind of malware presents to the small to medium sized business who commonly use these kinds of free and open source tools to build up and maintain their online presence.
While hackers continue to derive value and pleasure out of disrupting the lives of ordinary citizens and companies, the best option is to adopt strong password policies, two-factor authentication options (where they exist) and robust anti-virus and malware security software throughout the business, such as AVG Business Edition 2013.