Internetworkers: http://www.ibiblio.org/internetworkers/

[Mark Turner <jmarkturner AT gmail.com>]

I recommend you heed Google's warning. Back in Dec 2007 I had this 
happen to my blog. It took me four months to figure out what happened.

What occurred in my case was that hackers took advantage of a Wordpress 
vunlerability to replace my uploaded images with PHP code. That code 
would show my original image but also add some javascript code which 
would redirect traffic from my site to others. The desired effect was 
allegedly to boost the other sites' Google page rankings.

I think the hackers took advantage of a security vulnerability in a tool 
that's ironically used to block spam: Bad Behavior. As most security 
sites mention, how the hack succeeds is not really known.

To fix, I've made a point to upgrade Wordpress as soon as new releases 
come out. I also set up a cron job to periodically search uploaded 
images and change ownership from the apache user to my user. That way 
Wordpress cannot be used to overwrite them.

See my post on the matter here:
http://www.markturner.net/2008/04/23/wordpress-hacked/

...and the site that told me about iframe hacks:
http://www.spam-whackers.com/blog/2007/09/27/iframe-hack/

Cheers,
--
Mark Turner
www.markturner.net

 Gregory S. Hopper wrote:
> It happened to me when I was searching for "kurt warner" this morning, 
> including identifying wikipedia pages as "malicious".  If I cut and 
> pasted the URL into the browser, though, it went right to the page.