Axing ‘admin’ as your username
From Dennis Murphy, Startup Mackay
I like WordPress, it's amazingly easy to set up and, if you’re a cowboy coder like me (ie no formal web coding experience), you can tinker with plugins and themes to make a website look and do what you want without too much fuss.
Doing some upgrade work recently on a couple of WordPress installations at home, I noticed a huge amount of failed login attempts in my database. They were using the following usernames:
admin
root
www.mywebsitename.com
mywebsitename
Unfortunately, the reason for this is the huge amount of people leaving admin usernames on WordPress installations or their broadband modems/routers as default.
For hackers and script kiddies, this makes scanning the internet to find vulnerable PCs and infecting with malware, viruses, Trojans and spyware just that little bit easier.
Head to the Shodan.io search engine and type in 'router'. You can quickly find hundreds of thousands of vulnerable broadband modems/routers around the world.
Most exploits listed are as follows:
Old firmware;
They are using the default username for that router, eg 'admin';
An account on a router, firewall, or other network device has a default, null, blank, missing, or guessable password;
Incoming ports or configuration is incorrectly setup.
If you type in 'wordpress' in Shodan.io, you will see over a thousand WordPress installations, however information security researcher Brian Krebs recently wrote that a WordPress botnet* with over 90,000 servers has been tracked by a variety of security analysts.
They are scanning the Internet for WordPress installations, and then attempting to log in to the administrative console at these sites using a custom list of approximately 1,000 of the most commonly-used username and password combinations.
Incapsula.com
If I had to suggest one thing to help slow down the bad guys, is that if you ever have the option to change your username AND your password on a WordPress installation or a home router; change both!
I'm always looking to improve the way I operate in the online world and my WordPress admin usernames were changed quite a while back now. I try to keep my router and other home IoT (Internet of Things) device firmwares up to date, antivirus software up to date, operating systems patched, use 2-factor authentication where possible, and a password manager to keep all my random character passwords safe. This means I only really worry about all the other ways that nefarious online baddies can ruin my day, like how easy it is to use social engineering to steal my personal information.
*A botnet (also known as a zombie army) is a number of Internet computers that, although their owners are unaware of it, have been set up to forward transmissions (including spam or viruses) to other computers on the Internet.
