Yes! Many users have reported constant errors and the horrible horrible WordPress White Screen of Death.

Some background about La Prensa

  • La Prensa is one of the biggest newspaper in the Nicaragua.
  • It runs on Worpdress. Previously to running on WordPress it ran on a custom CMS
  • It runs on AWS with EC2 instances and RDS databases.
  • It uses AWS CloudFront for cache service.

Below we are going to break down more info!

La Prensa’s core: WordPress

Yes, as you can see on BuiltWith.com the site itself runs on WordPress, we do not know which version as it is hidden for security purposes. What I do know about it is that is running on a WordPress Multisite edition.

We do know it also uses Contact 7 & a Flip book plugin for image Gallery.

A good thing that I noticed is that they have XML-RPC disabled, if you have been reading my blog, on previous articles I have stated that is is an important security fix to disable this feature to avoid bruteforce attacks.

 

La Prensa runs on Amazon Web Services (AWS)

Yes, let’s see the facts:

Name Servers – Amazon Route 53

Run this command on your terminal:

dig laprensa.com.ni ns

and you will get this (or something similar):

laprensa.com.ni. 160353 IN NS ns-1491.awsdns-58.org.
laprensa.com.ni. 160353 IN NS ns-1654.awsdns-14.co.uk.
laprensa.com.ni. 160353 IN NS ns-229.awsdns-28.com.
laprensa.com.ni. 160353 IN NS ns-831.awsdns-39.net.

Those nameservers are AWS Route 53 Nameservers. See more about AWS Route 53.

www A records

Then the next step is to determine where the http://www.laprensa.com.ni is pointed at, so you go to your terminal again and run this command:

dig www.laprensa.com.ni 

And you will get a similar output to the one below:

www.laprensa.com.ni. 60 IN A 54.149.215.96
www.laprensa.com.ni. 60 IN A 50.112.175.81

Now to know who that IP belongs to we can run the following command:

whois 54.149.215.96

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# http://www.arin.net/public/whoisinaccuracy/index.xhtml
#
#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 54.149.215.96"
#
# Use "?" to get help.
#
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=54.149.215.96?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#
NetRange:       54.144.0.0 - 54.159.255.255
CIDR:           54.144.0.0/12
NetName:        AMAZON
NetHandle:      NET-54-144-0-0-1
Parent:         NET54 (NET-54-0-0-0-0)
NetType:        Direct Allocation
OriginAS:
Organization:   Amazon Technologies Inc. (AT-88-Z)
RegDate:        2014-10-23
Updated:        2014-11-13
Ref:            http://whois.arin.net/rest/net/NET-54-144-0-0-1
OrgName:        Amazon Technologies Inc.
OrgId:          AT-88-Z
Address:        410 Terry Ave N.
City:           Seattle
StateProv:      WA
PostalCode:     98109
Country:        US
RegDate:        2011-12-08
Updated:        2014-10-20
Comment:        All abuse reports MUST include:
Comment:        * src IP
Comment:        * dest IP (your IP)
Comment:        * dest port
Comment:        * Accurate date/timestamp and timezone of activity
Comment:        * Intensity/frequency (short log extracts)
Comment:        * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time.
Ref:            http://whois.arin.net/rest/org/AT-88-Z
OrgTechHandle: ANO24-ARIN
OrgTechName:   Amazon EC2 Network Operations
OrgTechPhone:  +1-206-266-4064
OrgTechEmail:  amzn-noc-contact@amazon.com
OrgTechRef:    http://whois.arin.net/rest/poc/ANO24-ARIN
OrgNOCHandle: AANO1-ARIN
OrgNOCName:   Amazon AWS Network Operations
OrgNOCPhone:  +1-206-266-2187
OrgNOCEmail:  amzn-noc-contact@amazon.com
OrgNOCRef:    http://whois.arin.net/rest/poc/AANO1-ARIN
OrgAbuseHandle: AEA8-ARIN
OrgAbuseName:   Amazon EC2 Abuse
OrgAbusePhone:  +1-206-266-4064
OrgAbuseEmail:  abuse@amazonaws.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/AEA8-ARIN
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# http://www.arin.net/public/whoisinaccuracy/index.xhtml
#

As you can see based on the all the facts, La Prensa Nicaragua is indeed in AWS.

La Prensa is cached by AWS CloudFront

After doing a quick review of the site’s source I found that it was using CloudFront using the following CNAMEs:

  • laprensa11.doap.us
  • laprensa12.doap.us
  • laprensa13.doap.us
  • laprensa14.doap.us
  • laprensa15.doap.us
  • laprensa16.doap.us
  • laprensa17.doap.us
  • laprensa18.doap.us
  • laprensa19.doap.us

They are all CNAME’s for d130eh1tuk2jcl.cloudfront.net. 

But even with CloudFront enabled we (and I mean Nicaraguans) have seen the site go down several times lately. There is something fishy right there.

Suggestions

  1. Due to the fact that this is a site with a lot of traffic. Which means that it probably takes 2 Million hits a month, I do think that the wp-login.php should either be changed/renamed/moved or that a security plugin should be implemented to limit the login attempts. I tried to login more than 10 times without getting not even a warning. This obviously leaves the door opened for someone to do a script that does a lot of HTTP POSTS to this file to try to authenticate.Some options are:

    – WordPress Limit Attempts by Johanee
    Bullet Proof Protection by AITpro
    Wordfence Security by Wordfence

     

  2. Improve the UI/UX. Clearly on this El Nuevo Diario is a huge winner by far.

What do you guys think I missed ?

Advertisements