The short write up, titled Distributed WordPress admin account cracking, exposes a malicious script which was written specifically to crack WordPress admin passwords.

The acquired script is written in PHP and performs brute force cracking attempts to WordPress admin accounts

[...]

Now, the interesting thing about the script is that it allows distributed cracking. Information is saved in a MySQL database and the script actually connects directly to the main database. This allows the attacker to run many simultaneous scripts – each of them will take 200 new URLs and mark them with the brute forcer’s ID ($colo).

There is nothing new or revolutionary about this script. If you have a beefy password and are up-to-date (2.8.6 as of today!) there’s no reason to worry. But I believe this illustrates the importance of doing everything possible to secure your website.

In my last post, I embedded Brad’s WordPress security presentation he gave at WordCamp NYC. It contains simple yet effective ways to secure your WordPress installations – definitely worth a quick look.

I’ve had a few people ask me what are the quickest/easiest ways to get started securing their WP site. Almost every single thing in Brad’s presentation is important, but in my mind 2 things are the most important and can be executed in a matter of minutes.

Delete your ‘admin’ account. Yes, that’s right. Nuke it. Scripts such as the one mentioned above try to gain access to your website by logging into the admin account – the account with the user name ‘admin‘. Create a new account, something like RobSmith (or anything other than admin!), give it admin privileges, and then delete the default admin user. You will thank me later.

Don’t use wp_ as your default prefix. You probably don’t remember, but when you were flying through WordPress’s famous 5 click install one of the options it asked you for was the default WordPress prefix to use with the database. That’s right, I figured you didn’t remember. By default it’s set to wp_ – this should be changed. If you have already setup your blog, you can change it using some phpmyadmin trickery, but make sure you know what you are doing first.

As WordPress becomes even more mainstream (gasp!) it will continue to be attacked by script kiddies and other nefarious characters. However by staying up to date and taking the appropriate steps to secure your site, you really don’t have anything to worry about.