Blog post replaced by spam

  • Resolved morshus

    (@morshus)


    17 years, 1 month ago

    A few minutes ago I discovered that an extra post had been added to my WordPress blog by ‘admin’ yesterday evening, titled “1” with viagra spam as content. But even worse was that the content of my most recent post, which I had posted as ‘admin’, had also been replaced by this spam.

    Has anyone any idea of what is happening here? Have I been hacked, or is someone maybe exploiting the “Post via e-mail” function? (which I have disabled now, just in case)

Viewing 7 replies - 16 through 22 (of 22 total)

  • What do we need to do to secure our sites, since it’s not an issue of password strength?

    Im secure ?? Always have been (she says, tempting fate)

    Yeah, I’ve always looked up to you in this area. Your ideas are different, and they seem to be working. Mind shooting me an email with some pointers? Pretty please?

    I misread your post, I saw this,

    What we need to do to secure our sites, …

    So I was agreeing ??

    As far as tips, I’m just anal as hell, and I watch everything. my mod_security logs are tailed, and read daily.

    I try to lock down stuff I dont need.

    Ive removed the possibility of anyone getting path info, something WP handles horribly.

    Ive blogged about that.

    I dont EVER display MySQL errors.

    Ive renamed my users table to something completely unique. And I dont use wp_ as a prefix, ever ??

    Theres a host of things you can do that can sit in the way of a successful attack.

    I log and see 100s of attempts a day, I cant stop the attempts, but I can improve my odds.

    Thread Starter morshus

    (@morshus)

    Right, almost a week has past and my site still looks OK. My host (Dreamhost) suggested that this could have been an SQL injection error, and WordPress has since then released version 2.3.3, patching “that a specially crafted request would allow a user to edit posts of other users on that blog”. I of course upgraded as soon as possible, from 2.3.2 to 2.3.3

    So for now, I think I’ll tag this topic as resolved. Thanks everybody for your help, it is good to see that the community and WordPress responds so fast and thoroughly.

    @whooami Gracias.

    Thread Starter morshus

    (@morshus)

    By the way, the WordPress Podcast Episode 34 mentions this about the security bug that WordPress 2.3.3 should fix: “The security bug affects only blogs that allow users to register”.

    My blog did allow anyone to register, so I immediately changed this. Just in case.

Viewing 7 replies - 16 through 22 (of 22 total)
  • The topic ‘Blog post replaced by spam’ is closed to new replies.