XMLRPC attack resulting in performance drop

  • Resolved shadowrider921009

    (@shadowrider921009)


    11 years, 5 months ago

    Dear BruteProtect

    Unfortunately today my new site (still in production) was targeted by an attack (most likely the old scripted XMLRPC) which targeted the xmlrpc.php file on my WordPress install.

    Fortunately the attack lasted only over an hour and no damage was caused due to a couple of preventative measures already in place on my WP install as well as having everything up-to-date. However, I did have BruteProtect which looks like it attempted to protect the site but o what degree I’m note sure.

    However, what this attack did result in was in fact a DDOS as PHP started to struggle with the number of requests. In future I should have more in place to prevent this as I will have CloudFlare enabled amongst a series of other minor DDOS protection tools.

    APDEX & RPM Graph
    Error Graph

    Here is a report from NewRelic:

    Error message
E_WARNING: Cannot modify header information - headers already sent

Stack trace
…lled at /srv/users/serverpilot/apps/***/public/wp-includes/
class-IXR.php (507)
…lled at /srv/users/serverpilot/apps/***/public/wp-includes/
functions.php (2577)
in _xmlrpc_wp_die_handler called at ? (?)
…lled at /srv/users/serverpilot/apps/***/public/wp-includes/
functions.php (2375)
…erpilot/apps/***/public/wp-content/plugins/bruteprotect/
bruteprotect.php (394)
…erpilot/apps/***/public/wp-content/plugins/bruteprotect/
bruteprotect.php (358)
…erpilot/apps/***/public/wp-content/plugins/bruteprotect/
bruteprotect.php (141)
in BruteProtect::brute_check_preauth called at ? (?)
… called at /srv/users/***verpilot/apps/***/public/wp-includes/
plugin.php (214)
…lled at /srv/users/serverpilot/apps/***/public/wp-includes/
pluggable.php (557)
…users/serverpilot/apps/***/public/wp-includes/
class-wp-xmlrpc-server.php (223)
…users/serverpilot/apps/***/public/wp-includes/
class-wp-xmlrpc-server.php (3954)
…users/serverpilot/apps/***/public/wp-includes/
class-wp-xmlrpc-server.php (519)
…lled at /srv/users/serverpilot/apps/***/public/wp-includes/
class-IXR.php (467)
…lled at /srv/users/serverpilot/apps/***/public/wp-includes/
class-IXR.php (417)
…lled at /srv/users/serverpilot/apps/***/public/wp-includes/
class-IXR.php (390)
…users/serverpilot/apps/***/public/wp-includes/
class-wp-xmlrpc-server.php (159)
…erve_request called at /srv/users/serverpilot/apps/***/public/
xmlrpc.php (84)

    I have also provided you with a copy of my Nginx Access Log and a consolidated list of IP’s which were used in the attack. 292 Unique IPs to be exact.

    Nginx Access Log
    List of IP’s

    This appears to be a botnet (possibly infected shared/WordPress/vps servers).

    I’m not sure to what degree you guys are able to help block these IPs:

    • Possibly integrating them into BruteProtect’s DB

    Any further advice, plugins, server software, etc which we could use to avoid such attacks in future would be sincerely appreciated.

    • For instance would you suggest adding this list to my .htaccess file as deny all?

    Kind regards
    Jeremy

    Have a merry Christmas!

    PS: A little more info regarding my server setup:

    • Server: DigitalOcean 1CPU & 512RAM (1 WordPress Install)
    • CP: Server Pilot
    • PHP: 5.6 | Apache 2.4 | Nginx Stable | MySQL
    • WordPress: WordPress 4.1
    • Plugins: BruteProtect, Akismet, Disable XML-RPC Pingback
    • Other: .htaccess edits

    https://wordpress.org/plugins/bruteprotect/

Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter shadowrider921009

    (@shadowrider921009)

    11 years, 5 months ago

    Plugin Contributor Sam Hotchkiss

    (@samhotchkiss)

    11 years, 4 months ago

    Hi Jeremy– Merry Christmas! Thanks for using BP and for your detailed report here!

    I went through and spot checked the list of IPs that you provided, and all 10 that I checked were on our current block list, probably because they were contributed by your site! We don’t have any technical means to manually add IPs to our list, but they are cycling through all the time.

    If you are seeing ongoing attacks from these IPs, then it could be useful to add them to your htaccess, but if the attack has subsided, it’s probably not worthwhile (and can have performance ramifications by adding this many IPs).

    For additional tools to round out your security solution, I’d certainly recommend both iThemes Security (for closing up other potential holes in your armor) and Sucuri (for a premium firewall solution that will stop attacks before they even get to your server).

    Good luck!

    Best,
    Sam

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘XMLRPC attack resulting in performance drop’ is closed to new replies.