• Website Security
• WordPress

With last month’s major hacking attack on WordPress sites, I thought it would be appropriate to discuss website security. I know, I know... exciting topic, right? It isn’t too exciting until you’ve been hacked. So, stick with me for a few minutes and we’ll cover some of the basics to help keep you and your website safe.

With last month’s major hacking attack on WordPress sites, I thought it would be appropriate to discuss website security. While the attack was focused on WordPress, it could just as easily happen to any content management system such as Drupal or Joomla. I know, I know... exciting topic, right? It isn’t too exciting until you’ve been hacked. So, stick with me for a few minutes and we’ll cover some of the basics to help keep you and your website safe.

We’ll start with just a little background on last month’s WordPress attack and then talk about some common reasons why your website might be a target. We’ll follow up in the next post with some basic precautions you can take to help keep your site safe.

Background on the WordPress Attack

Early in April, WordPress users across the world were attacked in a massive hack attempt. Millions of websites were attacked using over 90,000 compromised computers. The hackers weren’t attacking security flaws within the software per se. Rather, the hackers were taking advantage of the fact that many people do not take basic security precautions. In essence, the hackers were looking for the easy scores… the “low hanging fruit.”

The WordPress attack was what is known as a Brute Force attack where the hackers tried to login to the WordPress site using the username ‘admin’ and guessing the password using common (very insecure) passwords such as ‘123456’ or ‘222222’ or ‘qwerty’ (look at your keyboard for that one). They used a large network of compromised computers and servers, which they had already hacked, to create a massive attack on other websites. These computers were used in an automated fashion to attempt to login to the WordPress sites. Once logged in, the hacker would have control over the website, which could then be used to launch further attacks. Chances are, many of these website owners are unaware that they have even been hacked.

Why would anyone hack my site? I’m not running e-commerce...

A common response from many business owners is “Why would anyone want to hack my site? I’m not running e-commerce. I don’t have any credit cards online to steal.” While credit card and data theft are common reasons for hacking, there are many other reasons why a hacker may be interested in your website. Here are a few common ones just to give you a taste:

1. To use your site for other attacks

Hackers that want to do broader attacks will create a botnet (a large network of compromised computers) that they can use to attack other sites. A botnet makes it harder for the authorities to detect who is doing the hacking and also makes it harder to stop. These botnets can be a broad hacking attempt like we saw last month with the WordPress attack, or it could be a “Distributed Denial of Service” (DDoS) attack where they try to overwhelm a site with so much traffic that the website shuts down. In recent months, these have been used in attacks against financial institutions as well as government websites and systems.

2. To use your site for downloading malware (eg Trojans, Viruses, and other bad stuff)

Hackers who want to use malware to infect other people’s computers need a site or sites on which to store the dangerous files. They obviously don’t want to use their own servers, which could easily be traced back to them. So, they will hack a site and upload their malware to it. Then, when the hackers send out their spam, the unsuspecting people may actually be downloading the malicious files from your website.

3. For fun or bragging rights

Oftentimes young hackers want to explore and learn about hacking or may just want to say “Hey, look at what I can do.” They will often deface your site so that they can brag to their friends. For instance, they may overwrite your homepage so that it says “Hacked by (fill in the blank).” While this may or may not be dangerous, such incidents certainly can be embarrassing for you and potentially cost you business.

Conclusion

There are many other reasons why hackers do what they do. But hopefully it is clear that you don’t have to be an e-commerce site to be a target. When you put your new site online, you are waiting minutes - not days or weeks or months - but minutes before the first hacking attempt. Hacking goes on 24x7 from all over the world! With that in mind, you need to be sure that you are taking the proper basic security precautions. Next week, we’ll look at some of the basic security precautions that every website owner should be taking to protect his or her website.

Can we help?

Of course! Our website maintenance services will help keep your site safe. Contact us today to learn more.

• Prev
• Next