In the past three days I’ve seen multiple attacks against an ancient (i.e., 2.5 year old) security hole in the Joomla imgmanager plugin you can find documented here. The attacks came from a Thailand ISP and a Russian cloud service provider. The attacks start with a request similar to this one: POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=cf6dd3cf1923c950586d0dd595c8e20b HTTP/1.1 The POST content attempts to create a file named bogel.gif that contains a PHP program that was compressed, rot13 encoded, then base64 encoded.

The following movie came to my attention thanks to Phil Plait’s Bad Astronomy blog. Since today is the 70th anniversary of America’s bombing of Hiroshima the following video showing when and where nuclear explosions have occurred from 1945 to 1998 is relevant and sobering. [https://www.youtube.com/embed/cjAqR1zICA0?feature=oembed] I was born in 1961 and remember “duck and cover” drills at school. When going shopping at the local mall or department store meant looking for the nuclear civil defense fallout shelter signs indicated you should go in the event of a nuclear explosion.

My blog has been down for the past 24 hours because I decided to upgrade my system to the Mac OS X El Capitan beta release. I first upgraded my Macbook Pro laptop which went smoothly. Unfortunately that wasn’t a good indicator for how the upgrade of my Mac Pro server would proceed. The first problem was due to an old driver for my CalDigit FASTA-6GU3 (not Pro) PCIe card. After the first attempt to upgrade my server it consistently crashed while booting when it tried to load the USB driver for that card.

As part of switching from AT&T to Comcast I decided to upgrade my router. Since I was already using an older Asus router running Tomato firmware I opted for the Asus RT-AC68U. And rather than flashing Tomato on it I decided to try asuswrt-merlin which is basically the stock Asus firmware with bug fixes and some useful enhancements. One of the useful enhancements is support for custom scripts to deal with situations the GUI doesn’t handle.

Today I saw the first attempt by malware to write a spam comment on my WordPress blog that was not a blatant attack. Today’s attempt was a perfect emulation of a human registering an account at my blog in order to post a comment (note that I don’t require registration to post a comment). That emulation included appropriate delays between the relevant HTTP requests and spanned four minutes and eleven seconds.

Short version: I switched from one evil monopoly (AT&T) to another (Comcast). My Internet connection speeds increased by a factor of 75 (1.2 Mbps to 89 Mbps) and the cost dropped 28% ($70 to $50). 2015-07-25: A Sonic.net representative reached out to me to ask if I had contacted them about upgrading my service. So I’ll clarify that I was already paying for the highest speed tier they offer. Which until recently provided me the approximately 5.

Two days ago I started seeing a massive increase in attacks trying to guess WordPress credentials via the xmlrpc.php module. Between 2015-01-01 and 2015-07-10 I saw 155 attempts to guess WordPress credentials via “POST /xmlrpc.php” requests. And 114 of those attempts occurred between 02-05 and 02-22. Those 155 attempts represent an average of 0.8 per day. Since 0300 hours on 07-11 I’ve seen 215 attacks of that nature. For an average of 87 per day — a two order of magnitude increase.

A week ago I noticed a significant number of attacks against my web site originating from ToR (The Onion Router) exit nodes. I looked more closely at my logs and found that starting on June 27 every single request from a ToR exit node has been an attempt to guess WordPress account credentials. Those attacks represent 57% of the requests I’ve recorded since the start of 2015 and occurred in just the most recent 6% of that interval.

I can’t take credit for this post. It came to my attention via a comment at the blog Why Evolution Is True. That lead me to the Daily Kos article which was the source of the WEIT comment. That in turn lead me to the original article by Rev. Emily C. Heath. It’s a shame more religious people aren’t as reasonable and rational as Rev. Heath. It seems like this election season “religious liberty” is a hot topic.

It appears we have a new script kiddie on the loose. On 6/16 I saw 35 “POST /wp-login.php” attacks to guess WordPress account credentials with a user agent of “curl/…”. I saw another 37 attack on 6/17. I saw no such attacks going back to the start of the year (when I started tracking such things). After the attacks on those two days I didn’t see another one till today. In the past hour I’ve seen 14 such attacks.