Updates on CyberSecurity, WordPress and what we're cooking in the lab today.

Wordfence Now Includes 1.4 Billion Leaked Passwords in Password Auditing Feature

This entry was posted in Wordfence, WordPress Security on December 28, 2017 by Matt Barry   7 Replies

Last week, we reported a massive upsurge in brute force login attempts following the leak of a database of 1.4 billion clear text credentials. No one had seen 14% of the exposed username/password pairs before, making this a ripe opportunity for hackers to attempt to break into WordPress sites.

Historically, brute force attacks targeting WordPress have not been very successful. But this new database provides fresh credentials that, when matched with a WordPress username, may provide a higher success rate for attackers targeting sites that do not have any protection.

Password Auditing Improvements

Wordfence Premium includes a powerful Password Auditing feature. Using a GPU cracking cluster, we give you the ability to audit the strength of your admin and user passwords. You can learn more about how this feature helps protects your site here.

In response to this latest leak, we’ve merged this updated password list into our own large password list that we currently use to audit administrator accounts. Our previous list contained 269 million known passwords from various breaches, such as LinkedIn, and eHarmony. After merging and removing duplicates, this new list comes in at 609 million known passwords against which we can test your users’ passwords.

We ran some initial tests to compare how our previous list performed against the new list. In a random sampling of 100 user accounts, our previous list cracked 42% of the 100 password hashes. The current list cracks 57% when run against the same list. That’s a 36% increase over the previous capability. This means that a Wordfence password audit is now 36% more likely to find a weak password than before.

Recommendations

We strongly recommend that you upgrade to Wordfence Premium to benefit from the new capability we’ve added to our Password Auditing feature.

We also recommend you follow these additional steps:

  1. Install a firewall like Wordfence that intelligently blocks brute force attacks.
  2. Ensure that you have strong passwords on all user accounts, especially admin. Wordfence provides an option to enforce strong passwords when creating/updating a user account under “Login Security Options”.
  3. Change your admin username from the default ‘admin’ to something harder to guess.
  4. Delete any unused accounts, especially admin accounts that you don’t use. This reduces your attack surface.
  5. Enable two-factor authentication on all admin accounts. Wordfence Premium provides two-factor.
  6. Enable an IP blacklist to block IPs that are engaged in this attack. Wordfence Premium provides a real-time IP blacklist.
  7. Monitor login attempts by configuring alerts for when an admin signs in to your website. Wordfence (free version) provides this.
  8. Do not reuse a password on multiple services. That way, if you have a password from a data breach in this new database, it won’t be the same as your WordPress admin password. You can use a password manager like 1password to manage many passwords across services.

Did you enjoy this post? Share it!


4.24 (25 votes) Your rating:

7 Comments on "Wordfence Now Includes 1.4 Billion Leaked Passwords in Password Auditing Feature"

Robby Chen December 28, 2017 at 1:28 pm • Reply

The problem I found is that WordPress exposes author ID in the URL on the author page, which is your username. I managed to replace the username with the corresponding ID in the database through a plug-in. WordPress should not do that in the first place :(

Duncan White December 28, 2017 at 3:39 pm • Reply

Hi Robby Chen,

Thanks for the comment. Can you post the name of the plug-in that you used to replace the username with the corresponding name in the database? Much appreciated.

Robby Chen January 2, 2018 at 10:04 pm • Reply

Hi Duncan, sorry for the late reply and happy New Year. The plugin I'm using is called Change Author Link Structure, https://wordpress.org/plugins/change-author-link-structure/.

RunCloud December 28, 2017 at 5:54 pm • Reply

Imho, that depends on your permalinks settings.

Robby Chen January 2, 2018 at 10:34 pm • Reply

The permalink settings in WordPress is useless for author pages. It's used for SEO purposes for posts and categories-type pages.

adam philips December 29, 2017 at 1:20 am • Reply

ive been saying the same thing for over a year :( but my advice is to author from a non admin account, its the only working solution i could come up with on our sites

Robby Chen January 2, 2018 at 10:16 pm • Reply

A very good tip. But I'm sure that the hacker can think of a way bypassing the account limitations once he successfully logged into your site using brute force attack.

Get the latest WordPress security updates and news

Sign up for WordPress security alerts, Wordfence product updates and security news via email.