Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] this site may harm your computer?

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Mark Turner <jmarkturner AT gmail.com>
  • To: "Internetworkers: http://www.ibiblio.org/internetworkers/" <internetworkers AT lists.ibiblio.org>
  • Subject: Re: [internetworkers] this site may harm your computer?
  • Date: Sat, 31 Jan 2009 11:02:58 -0500

I recommend you heed Google's warning. Back in Dec 2007 I had this happen to my blog. It took me four months to figure out what happened.

What occurred in my case was that hackers took advantage of a Wordpress vunlerability to replace my uploaded images with PHP code. That code would show my original image but also add some javascript code which would redirect traffic from my site to others. The desired effect was allegedly to boost the other sites' Google page rankings.

I think the hackers took advantage of a security vulnerability in a tool that's ironically used to block spam: Bad Behavior. As most security sites mention, how the hack succeeds is not really known.

To fix, I've made a point to upgrade Wordpress as soon as new releases come out. I also set up a cron job to periodically search uploaded images and change ownership from the apache user to my user. That way Wordpress cannot be used to overwrite them.

See my post on the matter here:
http://www.markturner.net/2008/04/23/wordpress-hacked/

...and the site that told me about iframe hacks:
http://www.spam-whackers.com/blog/2007/09/27/iframe-hack/

Cheers,
--
Mark Turner
www.markturner.net

Gregory S. Hopper wrote:
It happened to me when I was searching for "kurt warner" this morning, including identifying wikipedia pages as "malicious". If I cut and pasted the URL into the browser, though, it went right to the page.





Archive powered by MHonArc 2.6.24.

Top of Page