Unauthorized Login with Administrator Access
-
Hello,
On Sept 20, 2016 Wordfence reported via email that two of my WordPress Sites has an unauthorized Login with administator access as shown below:Tuesday 20th of September 2016 at 10:26:53 PM
A user with username “xxxxxx” who has administrator access signed in to your WordPress site.
User IP: 173.227.74.5
User hostname: 173.227.74.5
User location: Austin, United StatesTuesday 20th of September 2016 at 10:32:57 PM
A user with username “xxxxxx” who has administrator access signed in to your WordPress site.
User IP: 173.227.74.5
User hostname: 173.227.74.5
User location: Austin, United StatesI am confused with this situation. Did someone hack my site? If so, I am really confused with how they did this. The username Wordfence reported was correct. Both passwords were strong random passwords with one password being 12 characters(numbers/upper & lower case letters), and the other being 16 characters(numbers/upper & lower case letters/symbols). I have been using Wordfence for over a year, and the options I have configured @ Wordfence > Options > Login Security Options are what I would call strict(Lockout after 6 login failures over 5 minute period, and w/ a 2 hr lockout time). How does someone crack my 12 & 16 character passwords on two of my sites, 6 minutes apart from each other, with the above Wordfence settings??
Below is the access login as captured by my hosts Raw Access Logs for both of the sites referenced above:
173.227.74.5 – – [20/Sep/2016:22:26:54 -0500] GET /wp-admin/ HTTP/1.1 200 21272 https://site.com/wp-login.php?redirect_to=http%3A%2F%2Fsite.com%2Fwp-admin%2F&reauth=1 Mozilla/5.0 (X11; Linux i686; rv:34.0; LojKmdU8218L7HlVU0GNgnnIjYNS5ifiOZTgox/lBTk=) Gecko/20100101 Firefox/34.0
173.227.74.5 – – [20/Sep/2016:22:32:58 -0500] GET /wp-admin/ HTTP/1.1 200 20009 https://site.com/wp-login.php?redirect_to=http%3A%2F%2Fsite.com%2Fwp-admin%2F&reauth=1 Mozilla/5.0 (X11; Linux i686; rv:34.0; LojKmdU8218L7HlVU0GNgnnIjYNS5ifiOZTgox/lBTk=) Gecko/20100101 Firefox/34.0
I discovered this the next morning about 12 hours later, and I changed the security keys/salts and passwords. I also ran a Wordfence Scan and found nothing. I have not found any unusual or malicious activity. There are 3 sites on this hosting account, and only the two above show the unauthorized access. I am the only one with access to my passwords, and my computer is using the latest version of ESET antivirus.
I should also note that I have isolated all the activity from this IP Address on both of my sites Raw Access Logs. I would be more than willing to send this information to you for review.
Thanks for your help,
Clint
-
Hi cwdv,
Did you find anything out about what happened? Has it happened again? Can you tell if anything changed on your site? Did they add any additional users?
Even if you have all your themes, plugins, and core updated, it is still possible for a hacker to find a weakness somewhere. One of the most common attacks is an XSS (cross site scripting). So if this was a hacker, it does not mean they guessed/brute forced your password. There are other ways to gain administrator privileges or access to your account. Changing your salts was a good idea and may have been what needed to happen to mitigate the threat if it was a cookie/session based. Plugins are typically the culprits. So make sure you have them updated and delete any unused/unneeded.
Reference: https://www.wordfence.com/learn/how-to-prevent-cross-site-scripting-attacks/
- The topic ‘Unauthorized Login with Administrator Access’ is closed to new replies.
