If you have been reading this blog for awhile, you will probably realize that onMason, like many WordPress blogs, has been under constant attack by hackers for quite some time. We’ve had brute force login attacks and comment spam problems (between April 2014 and June 2014). However, I like to think that we’ve done a decent job mitigating those attacks.

The latest thing that the hackers are trying to do is to exploit the XML-RPC interface. WordPress uses the XML-RPC interface to handle Pingbacks and allow remote publishing programs like the WordPress mobile app and Windows Live Writer to work.

To mitigate this latest attack, we are disabling the XML-RPC interface since almost no users actually use either Pingbacks or remote publishing programs.

During Spring Break (March 10, 2014 – March 16, 2014) we will be upgrading the software running onMason.

We do not expect any extended outages during the upgrade process.

After the upgrade, there will be a few changes to onMason. The most noticeable change will be a new look to the admin dashboard. It will feature a higher contrast color theme (with blacks replacing the grays). However, the menu items will largely remain the same.

We will also take the opportunity to remove a number of seldomly used, obsolete or broken plugins. Those plugins include:

Calendar* – we recommend that you use the Google Calendar Events plugin instead.

Do Follow* – the functionality of this plugin is already part of the standard SEO controls we offer.

Pulish2 – no alternative or replacement is planned.

Widget Logic* – no alternative or replacement is planned.

Wickett Twitter Widget – this plugin will be replaced with the Twitget plugin.

*These plugins were only available to a select number of sites.

It is important for us to remove these plugins as they affect the stability and performance of onMason.

I’m sure some of you have noticed that onMason has experienced some times recently when the site was either inaccessible or sluggish. The reason this has been happening is that onMason has been under constant attack since April.

An unknown party has attempted to gain access to the onMason administrator password using “brute force” methods. What this means is that the unknown party tries to log into onMason several times a second using random passwords, hoping to guess the correct password. This attack does not currently pose a threat to the security of onMason as they have been attempting to access non-existent accounts.

Unfortunately, the sheer volume of login attempts has caused performance issues with the site.

We do not believe this attack is specific to onMason or any of the sites we host since similar attacks have been reported by other WordPress sites.

See:
http://www.us-cert.gov/ncas/current-activity/2013/04/15/WordPress-Sites-Targeted-Mass-Brute-force-Botnet-Attack

In order to maintain the performance, stability and safety of onMason, we have implemented the following change:

After 5 incorrect login attempts, your account will be locked for 15 minutes. Please do try to login again before the 15 minutes are up as further attempts to login can result in an indefinite lock out.

If you are accidently locked out of your site or as experiencing any other issues due to the attacks, please contact the onMason Webmaster at webmaster@onmason.com.

We thank you for you understanding as we deal with this issue.

onMason Webmaster
Office of Student Media

We will be upgrading the software running onMason on Wednesday, October 3, 2012 between 10:00 a.m. – 11:00 a.m. As a result, onMason will be periodically unavailable during that time.

We will be upgrading the software running onMason on Thursday, August 23, 2012 between 10:00 a.m. – 11:00 a.m. As a result, onMason will be periodically unavailable during that time.

We will be upgrading servers in the next 24 hours. There may be some some downtime during this process. We apologize for any inconvenience this may cause, but this is necessary in order for us to continue to provide a high level of service to our users. onMason will be ready to go well before the semester starts next Monday. Again, thank your for your patience.

UPDATE: The upgrade has been completed. Please let us know if you run across any problems.