WordPress Hacking Methods
Since nowadays the hacking issues is getting hotter, we will share to you a little bit of hacking technique which is common to use by the hacker in order to compromise your site (mostly WordPress based site) also the way to prevent the attack.
Nuke attack basically is an attack based on command (using ping), sometimes hacker which is a newbie will use a tools to do it like WinNuke (a nuke tools for Windows). Nuke attack will do a tons of ping command in order to hang-up your server, in many cases if your server operating system is a Windows, this attack may caused your server to show a blue screen of death.
This attack method cannot be classified as hacking activity since the hacker is not targeting your data (just for fun). This attack always targeting a private server.
The hacker usually check your site using a tools like command prompt with command tracert to check whether you use a hosting provider or not.
Since this attack usually targeting a private server, then it is highly recommended to have a hosting provider to store your web files and data rather than use a private server. You can use a private server only if you have a medium knowledge about security.
DDOS attack basically is the same as Nuke, but the differences is when your server is going to hang-up, the hacker is implant some malware or a trojan into your site. This virus is used in order to take control of your site like updating a files, etc. The most common result of this type of attack is the hacker remove several required files like index.php or index.html
This type of hacking in several cases, the hacker just want to give you a message or just for fun (like the message on the image above, the hacker just want to test the security of your site). To test what files is being compromised, you can use this tools which is free to use.
Nowadays, DDOS attack already evolve to a more dangerous attack, this one is called by Permanent DDOS attack which targeting your hardware (Network Card or Router). This method target is to install a new firmware into your device then your device cannot be used for a while until you fix it (like flashing the device – your device may be death permanently)
To prevent this method, what you can do are:
- Use a proper and well-known hosting provider (like GoDaddy, Blue Host, etc.)
- Firewall, if you are using a private server, then you security must be the most important thing. Installing a firewall is the top issue
- Router, if you are using a private server, make sure if your internet line is not directly linked into your server pc, the line must be connected into a router first. The router these day already has its own firewall and several security tools
- Operating System, again, if you’re using a private server, then make sure if you are not using these operating system: Windows 2000 SP4, Windows NT 4.0 SP6a, and Windows XP SP2. Those operating system security is out of date and also not ready to prevent the DDOS attack
This technique which is the hottest issue right now, even Matt himself post about this issue on his own site. This technique is the only technique which is tools based hacking, also this technique is the second step if the hacking methods above are failed.
The hacker will create or use an algorithm tools in order to crack your site (the most common case, the hacker will use password crackers tools). This tools will try every possibility to find out the right combination of your site, also this tools will not stop until the hacker stop it.
In order to prevent this attack method, what you can do:
- Installing a login attempts plugin
- Using a captcha on your login page
This technique is requiring a set of hacking skills and many hacking experience, the hacker first will analyse your site, like what plugin you are using, where is your hosting located, how is the security, etc. The most common case is the hacker found a hole which is made by a plugin(s) you use (active plugins) and also the theme you use (active theme).
The only things you can do to prevent this attack:
- Change the default permalinks. Hacker usually use a tools named havij, we already try this tools and the results is it cannot crack your site if the permalinks is set to be post name (the other option also works! But not the default one)
- Use a common plugins, install a plugin carefully! Make sure if the plugins you use have a good response from the earlier user (at the WordPress.org plugin forum)
Ok, that’s it what you should know and aware.