{"id":362842,"date":"2023-11-03T11:41:01","date_gmt":"2023-11-03T10:41:01","guid":{"rendered":"https:\/\/blog.wedos.cz\/?p=362842"},"modified":"2023-11-03T11:41:05","modified_gmt":"2023-11-03T10:41:05","slug":"kdyz-utoci-162-tisic-unikatnich-ip-na-143-tisic-webu","status":"publish","type":"post","link":"https:\/\/blog.wedos.com\/cs\/kdyz-utoci-162-tisic-unikatnich-ip-na-143-tisic-webu","title":{"rendered":"Kdy\u017e \u00fato\u010d\u00ed 162 tis\u00edc unik\u00e1tn\u00edch IP na 143 tis\u00edc web\u016f"},"content":{"rendered":"\n<p>V pond\u011bl\u00ed 23. \u0159\u00edjna jsme za\u017eili nejrozs\u00e1hlej\u0161\u00ed \u00fatok na instalace WordPress. Naplno se probudil &#8222;Indon\u00e9sk\u00fd botnet&#8220; a za\u010dal masivn\u011b \u00fato\u010dit na soubory <code>xmlrpc.php<\/code>. A\u010dkoliv se \u00fatok sna\u017eil vypadat nen\u00e1padn\u011b, ve v\u00fdsledku byl opravdu masivn\u00ed.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">Indon\u00e9sk\u00fd botnet<\/h2>\n\n\n\n<p>Ka\u017ed\u00fd den d\u011bl\u00e1me n\u011bkolik agregac\u00ed dat s c\u00edlem zjistit nov\u00e9 potenci\u00e1ln\u00ed hrozby. Jednou z nich je hled\u00e1n\u00ed \u00fatok\u016f SQLi. Nov\u00e9 botnety se v\u011bt\u0161inou sna\u017e\u00ed chovat nen\u00e1padn\u011b ne\u017e narostou. Ti, co je ovl\u00e1daj\u00ed, je tak vyu\u017e\u00edvaj\u00ed k nen\u00e1padn\u00e9mu hled\u00e1n\u00ed zranitelnost\u00ed pro dal\u0161\u00ed r\u016fst. B\u011bhem \u0159\u00edjna jsme vid\u011bli pom\u011brn\u011b slu\u0161n\u00fd n\u00e1r\u016fst aktivit z Asie, kde v \u010dele byl poskytovatel &#8222;PT Telekomunikasi Indonesia&#8220;. Odsud tedy intern\u00ed ozna\u010den\u00ed &#8222;Indon\u00e9sk\u00fd botnet&#8220;. <\/p>\n\n\n\n<p>Kdy\u017e takto vid\u00edme lok\u00e1ln\u00ed n\u00e1r\u016fst r\u016fzn\u00fdch \u0161kodliv\u00fdch aktivit, v\u011bt\u0161inou to souvis\u00ed s roz\u0161\u00ed\u0159en\u00edm n\u011bjak\u00e9ho malware na mobiln\u00edch telefonech. \u010casto je to v oblastech, kde jsou z politick\u00fdch, n\u00e1bo\u017eensk\u00fdch anebo \u010dist\u011b obchodn\u00edch d\u016fvod\u016f omezen\u00e9 obl\u00edben\u00e9 mobiln\u00ed aplikace a lid\u00e9 si je pak stahuj\u00ed ze server\u016f t\u0159et\u00edch stran, kde mohou obsahovat \u0161kodliv\u00fd k\u00f3d. <\/p>\n\n\n\n<p>Pak prov\u00e1d\u00ed \u00fatoky p\u0159es s\u00edt\u011b mobiln\u00edch oper\u00e1tor\u016f a pevn\u00fdch p\u0159ipojen\u00ed, kter\u00e9 nab\u00edz\u00ed Wi-Fi.  Kdy\u017e jsme zagregovali data za 24 hodin, &#8222;PT Telekomunikasi Indonesia&#8220; byl v\u017edy vid\u011bt na vrcholu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">WordPress a xmlrpc.php <\/h2>\n\n\n\n<p>Soubor <code>xmlrpc.php<\/code> ve WordPress obsahuje skript pro implementaci XML-RPC protokolu, kter\u00fd umo\u017e\u0148uje syst\u00e9m\u016fm komunikovat mezi sebou. XML-RPC je protokol umo\u017e\u0148uj\u00edc\u00ed jednoduch\u00e9 vzd\u00e1len\u00e9 procedur\u00e1ln\u00ed vol\u00e1n\u00ed. V kontextu WordPressu <code>xmlrpc.php<\/code> umo\u017e\u0148oval extern\u00edm aplikac\u00edm (jako jsou mobiln\u00ed aplikace nebo jin\u00e9 webov\u00e9 slu\u017eby) komunikovat s WordPressem, nap\u0159\u00edklad pro publikov\u00e1n\u00ed p\u0159\u00edsp\u011bvk\u016f, spr\u00e1vu koment\u00e1\u0159\u016f a podobn\u011b.<\/p>\n\n\n\n<p>Nicm\u00e9n\u011b, <code>xmlrpc.php<\/code> se b\u011b\u017en\u011b st\u00e1v\u00e1 c\u00edlem \u00fatok\u016f z n\u011bkolika d\u016fvod\u016f:<\/p>\n\n\n\n<p><strong>Brute Force \u00fatoky<\/strong>: \u00dato\u010dn\u00edci mohou pou\u017e\u00edvat <code>xmlrpc.php<\/code> pro prov\u00e1d\u011bn\u00ed brute force \u00fatok\u016f na u\u017eivatelsk\u00e1 jm\u00e9na a hesla, co\u017e je metoda, kdy \u00fato\u010dn\u00edk opakovan\u011b zkou\u0161\u00ed r\u016fzn\u00e9 kombinace u\u017eivatelsk\u00fdch jmen a hesel, dokud se nep\u0159ihl\u00e1s\u00ed.<\/p>\n\n\n\n<p><strong>DDoS \u00fatoky<\/strong>: Soubor tak\u00e9 m\u016f\u017ee b\u00fdt zneu\u017eit k proveden\u00ed distribuovan\u00fdch denial-of-service (DDoS) \u00fatok\u016f, kde \u00fato\u010dn\u00edk vol\u00e1 <code>xmlrpc.php<\/code> s velk\u00fdm mno\u017estv\u00edm po\u017eadavk\u016f, co\u017e p\u0159et\u011b\u017euje server. <\/p>\n\n\n\n<p><strong>Amplifikace \u00fatok\u016f<\/strong>: <code>xmlrpc.php<\/code> lze zneu\u017e\u00edt k amplifikaci \u00fatok\u016f, kde \u00fato\u010dn\u00edk po\u0161le mal\u00fd po\u017eadavek, kter\u00fd vede k v\u011bt\u0161\u00ed odpov\u011bdi od serveru, zvy\u0161uj\u00edc\u00ed s\u00edlu \u00fatoku.<\/p>\n\n\n\n<p>Pokud m\u00e1te va\u0161i dom\u00e9nu chr\u00e1n\u011bnou <a href=\"https:\/\/www.wedos.com\/cs\/protection\/\" target=\"_blank\" rel=\"noopener\">WEDOS Global Protection<\/a>, tak je soubor <code>xmlrpc.php<\/code> chr\u00e1n\u011bn \u0159adou komplexn\u00edch pravidel, kter\u00e9 neomezuj\u00ed WordPress a z\u00e1rove\u0148 zahazuj\u00ed pokusy o \u00fatoky. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pond\u011bl\u00ed 23. \u0159\u00edjna 2023<\/h2>\n\n\n\n<p>Po p\u016flnoci n\u00e1\u0161 <a href=\"https:\/\/wedos.status.online\/cs\/\" target=\"_blank\" rel=\"noopener\">automatizovan\u00fd extern\u00ed monitoring agreguj\u00edc\u00ed data podle server\u016f ze v\u0161ech web\u016f  WEDOS OnLine<\/a> detekoval men\u0161\u00ed zpomalen\u00ed web\u016f na n\u011bkter\u00fdch serverech. Vy\u0161\u0161\u00ed z\u00e1t\u011b\u017e potvrdil i intern\u00ed monitoring z\u00e1t\u011b\u017ee server\u016f. <\/p>\n\n\n\n<p>No\u010dn\u00ed hl\u00eddka provedla p\u00e1r z\u00e1sah\u016f, kter\u00e9 situaci stabilizovaly. K \u017e\u00e1dn\u00e9 krizov\u00e9 situaci nedoch\u00e1zelo, proto\u017ee servery udr\u017eujeme polopr\u00e1zdn\u00e9, aby byl dostatek prostoru pro vyrovn\u00e1n\u00ed se s n\u00e1razovou z\u00e1t\u011b\u017e\u00ed. Nav\u00edc byl no\u010dn\u00ed provoz.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"914\" height=\"441\" data-src=\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2023\/11\/image.png\" alt=\"\" class=\"wp-image-362960 lazyload\" data-srcset=\"https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image.png 914w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-300x145.png 300w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-768x371.png 768w\" data-sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 914px; --smush-placeholder-aspect-ratio: 914\/441;\" \/><figcaption class=\"wp-element-caption\">Na grafu vid\u00edte pr\u016fm\u011brnou dobu vr\u00e1cen\u00ed xmlrpc.php pro \u00fato\u010d\u00edc\u00ed IP adresy. Po p\u016flno\u010dn\u00edm \u00fatoku zas\u00e1hla podpora a situaci stabilizovala.<\/figcaption><\/figure>\n\n\n\n<p>\u00datoky d\u00e1l prob\u00edhaly, na serverech to nebylo zn\u00e1t a\u017e do r\u00e1na, kdy za\u010dal b\u011b\u017en\u00fd denn\u00ed provoz a za\u010dala chodit hl\u00e1\u0161en\u00ed z WEDOS OnLine, \u017ee n\u011bkter\u00e9 servery jsou pomalej\u0161\u00ed ne\u017e je b\u011b\u017en\u00e9. Za\u010dali jsme se t\u00edm intenzivn\u011bji zab\u00fdvat a analyzovat provoz.<\/p>\n\n\n\n<p>Brzy se n\u00e1m poda\u0159ilo zjistit, \u017ee se jedn\u00e1 o \u00fatok na <code>xmlrpc.php<\/code>. IP adresy &#8222;Indon\u00e9sk\u00e9ho botnetu&#8220; n\u00e1m byly zn\u00e1m\u00e9. Ud\u011blali jsme tak hromadnou agregaci dat, a p\u0159esto\u017ee se \u00fato\u010dn\u00edci opravdu hezky sna\u017eili maskovat, tak pou\u017e\u00edvali pouze 6 spole\u010dn\u00fdch <code>useragent<\/code>. <\/p>\n\n\n\n<p><code>Useragent<\/code> je kr\u00e1tk\u00fd textov\u00fd \u0159et\u011bzec, kter\u00fd webov\u00fd prohl\u00ed\u017ee\u010d nebo jin\u00fd klient pos\u00edl\u00e1 webserveru p\u0159i ka\u017ed\u00e9m po\u017eadavku, a identifikuje tak sv\u016fj internetov\u00fd prohl\u00ed\u017ee\u010d, opera\u010dn\u00ed syst\u00e9m, verze a dal\u0161\u00ed informace. Slou\u017e\u00ed k tomu, aby server poznal, s jak\u00fdm typem za\u0159\u00edzen\u00ed nebo aplikace komunikuje. <\/p>\n\n\n\n<p>Sta\u010dilo tedy odfiltrovat z agregac\u00ed ostatn\u00ed <code>useragent<\/code> a nechat pouze tyto:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/52.0.2743.116 Safari\/537.36 Edge\/15.15063\nMozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/89.0.4389.114 Safari\/537.36\nMozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/89.0.4389.128 Safari\/537.36 Edg\/89.0.774.77\nMozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/87.0.4280.141 Safari\/537.36 Edg\/87.0.664.75\nMozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/88.0.4324.190 Safari\/537.36\nMozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/89.0.4389.72 Safari\/537.36<\/code><\/pre>\n\n\n\n<p>Tehdy jsme poprv\u00e9 uvid\u011bli rozsah \u00fatoku. I p\u0159es obrovsk\u00e9 mno\u017estv\u00ed request\u016f \u0161lo z jedn\u00e9 IP adresy jen jednotky a\u017e ni\u017e\u0161\u00ed des\u00edtky reuquest\u016f za hodinu. A to st\u00edhaly pos\u00edlat p\u0159es 700 tis\u00edc po\u017eadavk\u016f za hodinu na n\u011bjak\u00fdch 143 tis\u00edc (sub)dom\u00e9n.  Pokud bychom ze v\u0161ech na\u0161ich  server\u016f v re\u00e1ln\u00e9m \u010dase nestahovali access logy na jedno centr\u00e1ln\u00ed m\u00edsto a nevyhodnocovali, nem\u011bli bychom \u0161anci n\u011bco takov\u00e9ho dohledat. <\/p>\n\n\n\n<p>Takto rozlo\u017een\u00fd \u00fatok jako spr\u00e1vce jednoho webu nem\u00e1te \u0161anci poznat a popravd\u011b se proti n\u011bmu ani br\u00e1nit, proto\u017ee poka\u017ed\u00e9 p\u0159ijde request z jin\u00e9 IP.<\/p>\n\n\n\n<p>Vzhledem k tomu, \u017ee weby z\u00e1kazn\u00edk\u016f nepadaly ani nebyly nijak v\u00fdznamn\u011b zpomalen\u00e9, nebylo nutn\u00e9 nijak ukvapen\u011b jednat. Rozd\u011blili jsme si proto pr\u00e1ci.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Zjistit, kter\u00e9 weby t\u00edm nejv\u00edce trp\u00ed, a ty p\u0159esunout na WEDOS Global Protection. Pokud z\u00e1kazn\u00edk u webhostingu m\u00e1 na\u0161e DNS, ud\u011bl\u00e1me to automaticky za n\u011bj. Tyto sice rozs\u00e1hl\u00e9 ale primitivn\u00ed \u00fatoky web\u016fm chr\u00e1n\u011bn\u00fdm WEDOS Global Protection neubl\u00ed\u017e\u00ed. <\/li>\n\n\n\n<li>V\u0161echny probl\u00e9mov\u00e9 IP adresy, kter\u00e9 jsou nejaktivn\u011bj\u0161\u00ed, ale jinak na weby na\u0161ich z\u00e1kazn\u00edk\u016f nechod\u00ed,  do\u010dasn\u011b d\u00e1t na blacklist.<\/li>\n\n\n\n<li>Definovat jasn\u00e1 pravidla, jak chr\u00e1nit weby na webhostingu s minim\u00e1ln\u00edm dopadem na funk\u010dnost.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2023\/11\/image-1.png\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" width=\"1024\" height=\"309\" data-src=\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2023\/11\/image-1-1024x309.png\" alt=\"\" class=\"wp-image-363004 lazyload\" data-srcset=\"https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-1-1024x309.png 1024w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-1-300x90.png 300w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-1-768x232.png 768w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-1-1536x463.png 1536w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-1.png 1820w\" data-sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 1024px; --smush-placeholder-aspect-ratio: 1024\/309;\" \/><\/a><figcaption class=\"wp-element-caption\">Stav \u00fatoku a jeho postupn\u00e1 mitigace. <\/figcaption><\/figure>\n\n\n\n<p>Zhruba v 10:40 se v\u0161e rozjelo. Bylo zaj\u00edmav\u00e9 sledovat, jak na to &#8222;Indon\u00e9sk\u00fd botnet&#8220; reagoval. Jakmile jsme mu za\u010dali banovat IP adresy, dal\u0161\u00ed za\u010daly pos\u00edlat v\u00edce po\u017eadavk\u016f. Tak\u017ee celkov\u00fd sou\u010det moc neklesal. Nicm\u00e9n\u011b po n\u011bjak\u00fdch 50 tis\u00edc\u00edch IP adres\u00e1ch, kter\u00e9 jsme si byli jist\u00ed, \u017ee nebudou nikomu chyb\u011bt, bylo zn\u00e1t, \u017ee \u00fatok sl\u00e1bne. <\/p>\n\n\n\n<p>Pak p\u0159i\u0161el technik, kter\u00fd m\u00e1 na starosti webhostingy a proxy, kter\u00e9 jim pom\u00e1haj\u00ed se z\u00e1t\u011b\u017e\u00ed, s s \u0159e\u0161en\u00edm, kter\u00e9 implementovalo jedno z pravidel z WEDOS Global Protection pro v\u0161echny pr\u00e1v\u011b na proxy. Byl to trochu risk a tak jsme rad\u0161i dali i varov\u00e1n\u00ed na status str\u00e1nku. Nic se ale nerozbilo a \u00fato\u010dn\u00edk\u016fm se postupn\u011b za\u010dala vracet m\u00edsto 200 (fialov\u00e1) 403 (modr\u00e1). Tam, kde to \u00fapln\u011b ne\u0161lo, jsme nezasahovali, proto\u017ee vliv takov\u00fdch odchylek na servery byl minim\u00e1ln\u00ed. Z\u00e1kazn\u00edky s instalacemi WordPress obsahuj\u00edc\u00edmi n\u011bco, co <code>xmlrpc.php<\/code> v\u00fdrazn\u011b zpomalovalo, jsme dali na WEDOS Global.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"825\" height=\"442\" data-src=\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2023\/11\/image-2.png\" alt=\"\" class=\"wp-image-363017 lazyload\" data-srcset=\"https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-2.png 825w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-2-300x161.png 300w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-2-768x411.png 768w\" data-sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 825px; --smush-placeholder-aspect-ratio: 825\/442;\" \/><figcaption class=\"wp-element-caption\">Stav \u00fatoku a jeho postupn\u00e1 mitigace. <\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Pot\u00e9, co \u00fatok skon\u010dil<\/h2>\n\n\n\n<p>Na\u0161e nov\u00e9 odd\u011blen\u00ed datov\u00e9 analytiky pak dostalo za \u00fakol zp\u011btn\u011b analyzovat \u00fatok a identifikovat dal\u0161\u00ed zraniteln\u00e9 weby na WordPress. Tyto weby pak obdr\u017eela podpora pro do\u0159e\u0161en\u00ed p\u0159esunu na WEDOS Global Protection. <\/p>\n\n\n\n<p>A jak\u00e9 jsou fin\u00e1ln\u00ed statistiky?<br><br>Na webhostingy dorazilo: 17 771 841 request\u016f<br>Celkem c\u00edl\u016f (sub)dom\u00e9n: 143 727<br>Celkem \u00fato\u010d\u00edc\u00edch UIP: 162 952<br>Celkov\u00fd \u010das pro vygenerov\u00e1n\u00ed odpov\u011bd\u00ed webserver\u016f: 3870 h 22 min.<\/p>\n\n\n\n<p><em>Do statistik nejsou zapo\u010d\u00edtan\u00e9 zablokovan\u00e9 po\u017eadavky na WEDOS Global Protection, blacklistu a proxy.<\/em><\/p>\n\n\n\n<p>Jak vid\u00edte, nejednalo se o nic hrozn\u00e9ho. Proto jsme si mohli dovolit takto laxn\u00ed p\u0159\u00edstup. Na\u0161t\u011bst\u00ed maj\u00ed na\u0161e servery dostatek v\u00fdkonu a voln\u00e9 kapacity pro zvl\u00e1dnut\u00ed nadm\u011brn\u00e9ho provozu. Pokud by \u0161lo do tuh\u00e9ho, jednali bychom rychleji a tvrd\u011bji. <\/p>\n\n\n\n<p>A co botnet? Ten je st\u00e1le aktivn\u00ed. Je zneu\u017e\u00edv\u00e1n pro standardn\u00ed L7 DDoS \u00fatoky. Provedl jich do konce \u0159\u00edjna zhruba des\u00edtku, kter\u00e9 stoj\u00ed za zm\u00ednku. St\u00e1le tak\u00e9 prov\u00e1d\u00ed v men\u0161\u00edm m\u011b\u0159\u00edtku hled\u00e1n\u00ed zranitelnost\u00ed, ale u\u017e pou\u017e\u00edv\u00e1 jin\u00e9 useragent.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ochra\u0148te v\u00e1\u0161 WordPress s WEDOS Global Protection pluginem<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"885\" height=\"655\" data-src=\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2023\/11\/image-3.png\" alt=\"\" class=\"wp-image-363047 lazyload\" data-srcset=\"https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-3.png 885w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-3-300x222.png 300w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2023\/11\/image-3-768x568.png 768w\" data-sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 885px; --smush-placeholder-aspect-ratio: 885\/655;\" \/><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>Ochra\u0148te sv\u016fj web snadno a efektivn\u011b pomoc\u00ed na\u0161eho nov\u00e9ho WordPress pluginu WEDOS Global Protection. Plugin v\u00e1m umo\u017en\u00ed rychle a snadno vytvo\u0159it nov\u00fd \u00fa\u010det na WEDOS Global, nebo sp\u00e1rovat v\u00e1\u0161 existuj\u00edc\u00ed p\u0159\u00edmo z va\u0161\u00ed administrace WordPressu, ani\u017e byste museli opustit jej\u00ed prost\u0159ed\u00ed.<\/p>\n\n\n\n<p>Plugin si zdarma nainstalujte p\u0159\u00edmo v administraci WordPressu. Hledejte&nbsp;<a href=\"https:\/\/wordpress.org\/plugins\/wgpwpp\/\" target=\"_blank\" rel=\"noreferrer noopener\">WEDOS Global Protection<\/a>.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>V pond\u011bl\u00ed 23. \u0159\u00edjna jsme za\u017eili nejrozs\u00e1hlej\u0161\u00ed \u00fatok na instalace WordPress. Naplno se probudil &#8222;Indon\u00e9sk\u00fd botnet&#8220; a za\u010dal masivn\u011b \u00fato\u010dit na soubory xmlrpc.php. A\u010dkoliv se \u00fatok sna\u017eil vypadat nen\u00e1padn\u011b, ve v\u00fdsledku byl opravdu masivn\u00ed.<\/p>\n","protected":false},"author":2,"featured_media":365308,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[112],"tags":[149,37,221],"class_list":["post-362842","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bezpecnost","tag-botnet","tag-wordpress","tag-xmlrpc-php"],"_links":{"self":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/362842","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/comments?post=362842"}],"version-history":[{"count":6,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/362842\/revisions"}],"predecessor-version":[{"id":365310,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/362842\/revisions\/365310"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media\/365308"}],"wp:attachment":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media?parent=362842"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/categories?post=362842"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/tags?post=362842"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}