There is not alot of information yet.  The attack is known to be using forged or spoofed IP addresses. It is trying to guess passwords – that’s why it’s called a “brute force” attack.

SOLUTIONS – server level

The solution I’ve opted for – at least for now – is to protect all WordPress login pages with HTTP authentication on the server level with 1 script. This should foil all attacks – they wont even load the login page – unless the attack script gets smarter that it is now. The nice thing about this solution is that I can easily edit or reverse it without editing all sites.

SOLUTIONS – via plugins

First of all, make sure you don’t have any users with the default username “ADMIN” – that’s what this attack is targeting. But even if you don’t have any users with that name the attack can still slow down your server.

Stealth Login Page
After much hunting for a plugin-based solution I finally found this. It will easily let you obscure your login page so these attacks won’t have a chance to slow your server down. I suppose the server has a small overhead when dealing with the redirect for requests for the default login URL but that must be much lower than having to serve the login page and bounce incorrect logins (and track IPs of incorrect logins). It allows you to redirect all requests to the default login page while preserving requests that add a short configurable code to the login URL.

The better solution is to block the default login URL via http authentication as mentioned above – but many users will not know how to set that up.

Custom-login-stealth-login
update: This URL is not working today (april 26) but the rest of the site works so hopefully will be fixed soon
this plugin is a paid version of what the free plugin above does  ($9.99). It integrates with a free “Custom login” plugin that allows you to customize the look of the login page. It allows you to redirect or “kill” all requests to the default login page while preserving requests that add a short configurable code to the login URL. This plugin requires Custom Login > version 2.x which can be downloaded for FREE in the WordPress repo.

Google Authenticator
I have not used thus one but it sounds like a good option yet needs more “stuff”.  The Google Authenticator plugin for WordPress gives you two-factor authentication using the Google Authenticator app for Android/iPhone/Blackberry. You need the Google Authenticator app installed on your smartphone.

Captcha
This plugin will let you add a math CAPTCHA to the login page – and a variety of other locations as well. At this point the spam robots can’t get past even a simple CAPTCHA so it should do something to help with server slow downs due to frequent attacks – however the spam robots can still access the login page and therefore still slow down your server via many requests.

A better solution might be to block the submit button somehow – but I’m not sure such a plugin exists and if it did I’m not sure how easy it would be for the robots to still submit the form even if the UI blocked the submit button.

SOLUTIONS – other good plugins

These other plugins offer great features – but won’t help much for this particular attack…

1) Better WP Security
This plugin does alot more than limit your login attempts – so it has a chance of cleaning up whatever wil cause the next big security issue. it’s got a great ‘easy’ mode where it will highlight the 5 or so highest priority items that need attention. And it will clean those items with just a couple clicks. The plugin also has lots of useful information to teach you about security. The downside is that there are lots of tabs and lots of options and it takes time to find your way around.

2) Limit Login Attempts
This is nice and simple. as soon as you turn on the plugin it just starts working. It will escalate lockouts from 20min to 24 hours so that’s a nice feature. It’s default is 4 tries and in this current situation that might be a bit too many but it depends how many sites are on your server.

WORDPRESS SECURITY LINKS

• http://blog.hostgator.com
  
• http://blog.sucuri.net
• Forbes: Wordpress Under Attack: How To Avoid The Coming Botnet
• NextWeb summary
• Matt’s advice

security side note: the Social Media Widget plugin (social-media-widget) is being used to inject spam into websites and is recommended to be removed.

AI1EC has many more features than GigPress—so I’ll start with a list of the advantages of  the “All in one event calendar” (aka AI1EC) vs GigPress:

The sample below allows for a variety of shipping prices based on order total (but you could base it on total number of items too). It also adds sales tax – but only if your shipping address is set to California. Of course you could set it to any state. Note that the shipping field disappears when selecting a different state. The key is to set up a “subtotal” field and put your calculations in there.

There are some notes in this form – let me know if you have further questions about how this is set up in the comments below and I’ll do my best to help explain the options.

I want specifically to point out the design of their support page (they title it “empower”). It’s very impressive. They offer multiple ways to get involved in an interactive series of checklists. I’m not 100% convinced it’s what all visitors need – I would prefer a “quicklink” to just making a cash donation. But still it’s very innovative and other NGOs might find it inspiring. I can think of some other non-profits that I built WordPress sites for that could perhaps use a simper version of this kind of page to help communicate the many ways to promote their cause.

Want to get involved with Not For Sale? Want to be a part of the modern-day abolitionist movement? Not sure how to get started? This tool is designed to help identify which Not For Sale projects and programs are best suited for you.

By answering a few questions, the tool can tailor a list of action steps that will best help you get involved. Begin by choosing which areas of society you identify yourself, then you can refine your results by answering further questions about time commitment, community engagement, financial support and leadership. Let’s get started!

via Empower – Not For Sale: End Human Trafficking and Slavery.

Well, this is long overdue but I finally cleaned up my notes from WordCamp.

Adding custom content types: I’ve always been on the lookout for a Drupal-like “views” module for WordPress. These tools come close:

• Loop buddy
• Views and types
• Pods Framework: I used this one long ago but it’s evolved alot and looks like a great option

Other fun things I learned about

• SASS for CSS
• REM not em for best responsive CSS
• S2member for member and paid level management
• Hellobar: a simple idea: use the top 30 pixels of yoru site for eye-catching messages. Hellobar includes A/B testing and it’s own analytics so it might be worth paying for on a ongoing basis. Other similar solution like Foobar are just a plugin with no extra fees. (let me know if you have a free version you use)
• SlideDeck:  Slider & Gallery Plugin that gives a powerful UI and lots of sources and skins for building sliders
• Flare social sharing bar
• HappyTables: free restaurant website-building tool – developed around a customized version of WordPress

Chatting with Matt about new WordPress usage stats.

Notes from 2011

Apple Mail disabled the amazing “Letterbox” plugin after the recent Mac OS10.6.8 update. Here’s a link to an easy fix.

Letterbox is a plugin for Apple’s Mail.app that takes advantage of the full width of your monitor. It rearranges the interface into three vertical columns so the message pane is to the right of the message list, rather than below.

MailPluginFix is a free tool which will  fix any incompatible Mail.app plugin  after an update of Mac OS X.

via CODE2K:LABS – MailPluginFix.

Waterproof iPhone bike mount with integrated lens for wide angle video recording or “precording” while biking.

THE PROBLEM

Some bikers want to record their ride for fun. Others want to record their ride for the insurance of having a record of a collision. Everyone wants a cool case that is waterproof and easy to use while biking for maps, music, chatting, reading SMS etc.

This recent NYTimes article talk about the popularity of recording video while cycling

http://www.nytimes.com/2012/07/21/technology/bicyclists-using-cameras-to-capture-accidents.html

You already have that iPhone in your pocket while you are biking so why not use it as a safety device?

READ MORE AND VOTE UP MY IDEA: Quirky ideations | Waterproof iPhone bike mount with integrated lens for wide angle video recording or “precording” while biking..

Yes, you should use the lastest versions of WordPress core and for the most part the latest version of plugins. But of course incompatibilities arise so be careful when updating.

The #1 security measure I suggest is to remove “admin” user – many robots will assume you have a “admin” user and try to guess the password. By keeping this default user name you are giving away half of the username+password puzzle that is the barrier between your site getting hacked and your site staying safe.

Another concept is that some plugins change the way WordPress works so it’s more secure while others focus on malware scanning to see if anything has been hacked. Sucuri is a great plugin that scans for hacks – you can do the same free scan from their website. You can also pay them to actively scan and they will actually fix any issues that come up.  Code Garage does backups as well as malware monitoring so that’s a good option to explore also.

Plugins that do many security tasks

• WordFence: This is a great new plugin I’m testing out that offers a complete solution for free with an optional paid upgrade that actively scans your site from the outside to make sure it has not been hacked. So it combines security edits with malware monitoring.
• Better WP Security: I’ve been using this one for a while and it’s great. It has a “one-click” feature that will harden a number of security features very quickly.
• A good handful of features: Secure WP
• WP Security Scan

• Login LockDown an older simple plugin that works well but has not been updated recently. Getting the many emails it sent help me learn how many bots were randomly attacking my sites.
• Login Lock: like the above with with a few extra useful features like a button to force logout for anyone logged in. This plugin is no longer supported. another replacement option:  Login Security Solution
• Limit Login Attempts: yup, another plugin with similar features.
• The name says it all: the Replace WP-Version plugin
• Updated SSL Plugin: forces ssl anywhere passwords are asked for
• Timthumb vulnerability scanner: does a bit more than just check for that one giant security issue…

WordPress Ecommerce folks at instinct.co.nz have a great checklist for how to secure WordPress

GoodSync is a utility that provides all the tools you need to keep your data safe and up-to-date. It works by synchronizing (and backing up) files such as MP3s, Office docs, photos, financial documents,  between desktop HD/SSD, laptops, servers, and all manner of thumb/external drives.

GoodSync is very user-friendly—its’ got a geeky but usable UI and is full of functionality. If you need a too to backup your data to protect it from crashes or need to synchronize complex data on a network, this tool makes it simple to keep you data current and safe.

Compare to:

• Syncables 360
• SugarSync
• Allway Sync

GoodSync for Mac

Works amoung Mac OS devices or between Macs and cloud services like Amazon S3 and Google Drive. Connect to other computers and devices by using GoodSync Connect , which finds other devices installed with GoodSync on the internet or over a local network in a peer-to-peer style. Performs syncs over a number of other networks, including (s)FTP and WebDAV. Or sync with clouds including Amazon S3, Amazon Cloud Service, Microsoft SkyDrive, Google Drive (Docs), MobileMe iDisk, and Windows Azure. You can also sync with mobile systems like WinMobile and BlackBerry devices.

Important notes about GoodSync for Mac

• Free version gives 3 or fewer jobs and 100 or less files and folders in each job.
• You need one license per computer
• You do not uninstall the old version of GoodSync before installing a new one  unless you want to install into a different folder. The new version will keep the options and settings of the previous one.
• Any data stored in a file can be synchronized

Pricing

• GoodSync Desktop for Mac license for $39.95
• Other plans for PC, Mobile…

GoodSync for Mac review and tips

Tip: It’s important to create a folder at the destination first. I wanted to synchronize a folder “C:\testfolder” to a second drive (F). When I just set Good Sync “C:\testfolder” as the source and point it to F (as root) I thought Good Sync would create the folder for me but that’s not what happens. You will get  a message indicating the folder on F drive does not exist. If you tell it to go ahead and synchronize no files are copied.

Tip: The default is for Good Sync to only synchronize  when you manually tell it to. You can change that under View – Options-  Job name. You can tell it to synchronize automatically under a number of different schedules.

Bottom line: A great option for syncing data, a mature tool that can cover the bases for many use case scenarios.

Shrub & Co elixirs add depth and complexity to your drinks with a clever combination of sweet and savory notes. Rescued from the obscurity of the colonial era and reimagined for today’s craft cocktail enthusiast, our shrubs enhance your favorite concoctions.

visit: Shrub & Co | Cocktail mixer