• Home
• Subscribe
• Help
• Photos
• Videos
• SEO
• Follow Me on Twitter!

• Home
• About Dan Nedelko
• Case Studies
• Hire Me
• Sportsbook SEO
• Gambling SEO

Wordpress Injection Attack

March 4, 2009 Update: My plan has worked out very well and every­thing is back to nor­mal with­out too much of an inter­rup­tion. My request for Google site review took a total of 12 hours and it was com­pletely han­dled through Google Web­mas­ter Tools. Google spi­dered the entire site for about 6 hours check­ing every exist­ing page on the site from Moun­tain View Cal­i­for­nia. Around 6pm EST I was given a new notice in my Web­mas­ter Con­trol panel that the notice would be removed with the next update which took place about 90 min­utes later.

I’d like to thanks a few peo­ple who gave me some good advice. If this does hap­pen to you make sure that you:

1. Remove any old plu­g­ins may have or update them.
2. Ensure the source of the plu­gin is using best prac­tices for PHP cod­ing. If the plu­gin is not listed In the Offi­cial Word­press Plu­g­ins Direc­tory then be careful.
3. Add the fol­low­ing plu­g­ins: WP Secu­rity Scan and Word­press Fire­wall (Thanks to Ruud Hein for the suggestion!).
4. Backup your con­tent, themes, and plu­g­ins on a reg­u­lar basis so a roll back is easy in the event that you are attacked again.
5. Be care­ful of who you send your site to on Twit­ter! See the end of the post for the offi­cial Twit­ter email I received and this was the source of the attack.
6. This one is obiv­i­ous but make sure you Word­press ver­sion is cur­rent as many secu­rity fixes are imple­ment in point releases (ie 2.7.1).
7. Secure you Web Server or have your Sys­tem Admin­is­tra­tor or Web Host ensure that every­thing is in order.

/Update.

I woke up this morn­ing ready to get to work and as per usual I check my sites indexes in Google, Yahoo and MSN. Even though it’s a beau­ti­ful sunny day out­side I was shocked to see the following:

Bad News for Tues­day Morn­ing to be sure. So the ques­tion is what do I do and how do I get this bad mes­sage off my Search Listing?

I’m not too con­cerned to be hon­est except for the fact that my site is vul­ner­a­ble to this injec­tion attack. I would love to smack the hacker that insti­tuted this attack.

So first things first:

What is this mes­sage all about? Well when I viewed the source of my site I saw what is called an obs­fu­cated injec­tion attack on the footer of every sin­gle one of my pages. This is a bit of a pain since I am using Word­press MU with a num­ber of plugins.

That means that  the hack­ers could have injected their lit­tle code block into my theme, my plu­g­ins into the core Word­press MU files. Not a pretty thought to have to go through all of those areas to remove these indi­vid­ual code blocks. Bot­tom line: my site got hacked. What steps do I take to repair the dam­age that’s been done?

Has your Word­press site ever been hacked?

• Yes
• No

View Results

 Loading …

My plan to remove the PHP injec­tion attack:

1. Iden­tify which files on the web server are compromised.
2. Iden­tify if the com­pro­mised files are plu­g­ins, com­ments, themes, or Word­press Core files.
3. If the com­pro­mised file is a plu­gin then deter­mine if the plu­gin should be removed com­pletely (is it the source of weak­ness?) or sim­ply a vic­tim and should be reu­ploaded and reactivated.
4. Upload a clean ver­sion of Word­press MU core files. This pre­vents me from hav­ing to wade through all of the com­pro­mised files.
5. Go through com­ments and iden­tify any poten­tially mali­cious links to mal­ware sites. I am very lucky since I have recently moved the domain to a new server since my pre­vi­ous hor­ri­ble host dis­abled access to the php­MySQL instance through the cPanel (yes EMC Web Host­ing Sucks NEVER use them). This will not be a huge issue.
6. Go through my theme which is a cus­tomized ver­sion of Rev­o­lu­tion Theme by Brian Gard­ner. I fre­quently backup this theme since it is a a sim­ple mat­ter  of upload­ing the theme to the web server.
7. Visit Google Web­mas­ter Tools and sub­mit a request for Google to audit my site to remove the mali­cious tag­ging on my site.
8. Audit the entire site to ensure the mali­cious code in com­pletely removed.
9. Back up the theme again, ensur­ing I have the abil­ity to restore clean code in the event that I am on someone’s hack­ing list.
10. Harden Word­press MU to ensure that this does not hap­pen again.

That’s my plan. I am about half way through it but there are some seri­ous issues at play here since it is not only Google which is tag­ging my site as mali­cious (bad for busi­ness!). Check out the num­ber of blocks which exist:

Google Mali­cious Message:

I’m not Mali­cious but Google thinks I am so next step is to click on the SERP that’s when Fire­fox jumps in:

After click­ing the SERP Fire­fox jumps in and says I am an attack site. How fas­ci­nat­ing but just wait. It’s not over yet when I get to the site:

Fire­fox tool­bar warning

So clearly the pow­ers that be and the tools on my com­puter are work­ing hard to iden­tify mali­cious sites. It is very clear that this site could be mali­cious and even though it was through no intent on my part the bot­tom line is that my site was hacked and turned into an attack site. This is a good line of warn­ings to any user and in the time frame that I am repair­ing the site and hard­en­ing my Word­press to ensure this does not hap­pen again I don’t really mind hav­ing these mes­sages there.

They are good for users.

Update — Twit­ter just sent me the source of this injec­tion attack:

Uh oh! We found a bad apple in your Twit­ter feed.

We detected a link in your account point­ing to a phish­ing site or other harm­ful mate­r­ial that we iden­ti­fied as mal­ware. Here’s the trou­ble­some post:

“@BlogDuJour hey there try out my blog [ your unsafe link was here ] — I am in the process of redesign­ing now but should be back to nor­mal soon!“
March 02, 2009 22:07

We removed this update from Twit­ter. Please be mind­ful of oth­ers in the Twit­ter com­mu­nity, and post only safe links on Twitter.com.

Thanks! Twit­ter Support

Related arti­cles

• How to Upgrade to Word­Press 2.7 Safely and Ensure Com­pat­i­bil­ity (list-your-blog.com)
• Notes from the Search Mas­ters Con­fer­ence at Google (labnol.org)
• Search Engine Tips For Your Word­press Blog — Word­press SEO (kisaso.com)
• How To Make My Site Find­able And Vis­i­ble Inside Google SERPs? Here Is The Google SEO For­mula And Vis­i­bil­ity Toolkit (masternewmedia.org)

No related posts.

Comments

• Recent Posts

  • Internet Marketing Tweet Digest 2010-07-25
  • The Real Life Social Network
  • Internet Marketing Tweet Digest 2010-07-18
  • Internet Marketing Tweet Digest 2010-07-11
  • Internet Marketing Tweet Digest 2010-07-04
  • Internet Marketing Tweet Digest 2010-06-27
  • Internet Marketing Tweet Digest 2010-06-20
  • Internet Marketing Tweet Digest 2010-06-13
  • Internet Marketing Tweet Digest 2010-06-06
  • Internet Marketing Tweet Digest 2010-05-30

Copyright © 2008 Dan Nedelko : Internet Marketer · Dan Nedelko is the founder of Honeypot Marketing an Internet Marketing firm located in Toronto, Ontario and Vancouver, British Columbia · If you can't find what you are looking for please have a look at our Internet Marketing and SEO Resources.