When it comes to improving the poor state of security one of the major impediments is security companies. Far too often they either don’t seem to understand the basics of security themselves or are intentionally telling people things that are false as means to push products that are not needed.
While looking into something related to another post we ran into the security company WeWatchYourWebsite again. The last time we did that, we found them providing what was claimed to be an example of hacker looking for infected websites, but was in fact something very different, a hacker trying to exploit a vulnerability in a plugin that was never on a website. Amazingly they claim to “specialize in root cause analysis” despite not having a basic understanding of the topic.
Since then they put out a post showing they didn’t understand the difference between brute force attacks, which are not happening, and dictionary attacks. And a post with this troubling line in reference to a WordPress website:
In this instance the hackers were able to find the admin username and guess the password. So, even though the owner took the step of changing the admin username, using an easily guessed password negates that.
We really can’t emphasize this enough, WordPress usernames are not considered a secret and therefore changing them is not a security step that could be negated.
What makes that mention seems so odd, is they seemed to understand how easy it can be to get the username on a WordPress website currently:
First, the hackers worked at finding out the name of the admin user. There were a number of these in the logs:
“GET /?author=1 HTTP/1.1”
“GET /?author=2 HTTP/1.1”
“GET /?author=3 HTTP/1.1”
“GET /?author=4 HTTP/1.1”
…and continued on by incrementing the integer after “author=”
Apparently it worked as the customer had changed their username for admin.
So either they had seen that WordPress has a major security issue (if the usernames were meant to be a secret) or they should have realized that it isn’t meant to be secret and not made a statement implying otherwise.