Note: This post is a followup to the one here describing a coordinated attack on sites running WordPress.
My friend’s WordPress sites are still partly out of commission, following the sophisticated attack by pharma spammers that I talked about a few days back. Google has listed them again, though Google’s cache still shows some of the pharma spam. I’ve been continuing to investigate the attacks, and I’ve learned some new and interesting things about these attacks…including the fact that they are moving beyond WordPress and beginning to target another popular open-source platform, Joomla.
The first thing I did was start compiling a list of sites which have been compromised by this particular hack attack. To do this, I used Google’s site: command to get a listing of what my friend’s site looked like from Google’s point of view. The site: command can be used to get a list of how Google has indexed a site; for example, if you type
site:xeromag.com
into Google, you’ll see how it has indexed all the pages of my site. Next, I took unusual words and phrases from the pharma results in Google, and searched for those exact phrases. This gave me a list of tens of thousands of sites.
I then went down that list looking at each site. If I didn’t see any trace of the pharma spam keywords in the site, I did a second Google search, this time using that site and those same pharma spam keywords. I clicked on the Google link for those results and watched what happened. If I got redirected to a pharmacy page via a redirector at googl-analize.in, I knew it was the same attack, and I added that site to my list.
For example, here is what happens if you type
site:gregatkinson.com
(one of the hacked sites I found) into a Google search.
If you click on any of those links, you will not see any pharma spam. However, if you do the search AGAIN, this time using
theophylline site:gregatkinson.com
as your search term and you click on any of the links, you’ll be redirected to a pharmacy spam page.
Once I had built a list of affected sites, I then looked to see who their Web host was, and what content management software they were running. Nearly all of the sites were running WordPress, most of them fully updated and patched.
Nearly all. Not quite all, however. Some of the sites I found, I discovered, were running Joomla. This surprised me, and I think it helps rule out a zero-day exploit in WordPress as the attack vector. unless we are to believe that this one group of hackers has found and is exploiting identical zero-day flaws in both WordPress and Joomla and are attacking them the same way, which is possible but unlikely, I think the logical conclusion is that the attack vector is somewhere else.
Here’s the list of hacked sites that have all been attacked by he same person or persons who attacked my friend’s site that I’ve compiled so far:
Unless otherwise noted, the sites are running current WordPress installs.
As of yesterday, each of these sites would redirect via
*** WARNING *** WARNING *** WARNING ***
The sites googl-analize.in and sliceblogz.com are live as of the time of this writing. It appears that visits to this site result in blank pages unless the http-headers are set exactly right. However, these are sites that are being used in current hack atacks against many Web sites. I do not recommend visiting them.
I also discovered something else interesting. When I did Google searches for the exact phrases used in the WordPressand Joomla pharma spam hack attacks, many of the results I got were blog comment spam on various blogs. The blog comment spam is pretty straightforward; it was just your average, run-of-the-mill “buy cheap drugs here” rubbish with a link to a Web site.
The blog comment spam linked to
Those suspicions were confirmed when I did a Whois lookup on both sites.
| whois googl-analize.in
Domain ID:D5239480-AFIN Registrant ID:TS_16281729 Name Server:NS1.REGWAY.COM |
whois dwnloadz.in
Domain ID:D5093036-AFIN Registrant ID:TS_16281729 Name Server:NS1.REGWAY.COM |
It seems pretty clear to me that the same person is responsible both for blog comment spam and also for these attacks on WordPress and Joomla. It also seems to me that this person is quite busy tending his network of hacked sites; the behavior of the sites (now redirecting via sliceblogz rather than googl-analize.in, for instance, shows that he is able to make changes to the sites he hacks after the attack code has been installed).
The sliceblogz site is protected by private whois registration. It seems unlikely, though, that “Anatoly Vasserman” is the attacker’s real name.
Yet another surprise came when I examined the code that the hacked sites fetch from googl-analize.in (and presumably now from
Fortunately, a friend of mine recently showed me how to use wget to create arbitrary headers. When Google indexes a hacked site, the modified code serves a special page to Google’s spider; here’s what it serves up.
This content was fetched using “sfpulpit.com” as the name of the hacked site.
<h1>Order Carbamazepine overnight delivery</h1>
<br />where to purchase Tegretol 100mg low price United Kingdom without doctor prescription
<br />generic Tegretol fedex cod
<br />low price Tegretol in internet amex priority mail
<br />Tegretole pharmacies overseas
<br />Buy Carbamazepine without a rx overnight shipping
<br />buy Tegretol online by fedex
[snip]
.
.
.
[snip]
<br />Carbamazepine 200 mg buy online
<br />Low cost Carbamazepine and overseas
<br /><br /><br />Buy Carbamazepine offshore no rx fedex
<br /><br /><br />How to get Carbamazepine rx
<br />Cheapest prices for Carbamazepine cheapest online
<br />Order Carbamazepine overnight delivery
<br />Where to order Carbamazepine 400 mg discount United Kingdom online
<br /><b>Carbamazepine 400 mg buy England online mastercard</b>
<br /><i>Carbamazepine order online mastercard</i>
<br /><b>Order Carbamazepine overnight delivery</b>
<br />Where to order discount Carbamazepine 400 mg online
<br /><i>Order Carbamazepine overnight delivery</i>
<br />generic Tegretol buy cod brand
<br />No perscription Carbamazepine fedex delivery
<br />Carbamazepine Mississippi
<br />Order Carbamazepine 100 mg Canada visa
<br />Where to purchase Carbamazepine no doctor script online
<br />Buy Carbamazepine 400mg New Zealand without rx
<br/><h2>Cheap Carbamazepinee in uk at leicester</h2>
<br /><u>Low price Carbamazepine 200mg buy</u>
<br />Closest us generic equivalent to Carbamazepine in massachusetts lenox dale
<br />purchase generic Tegretol prescription online
<br />Buy Carbamazepine overnight cheap
<br />No prescription Carbamazepinee online
<br />Order Carbamazepine overnight delivery
<br />get Tegretol online amex no rx
<br />Order Carbamazepine 100mg cheap price online Canada
<br />Generic Carbamazepine onlin
<br />To buy Carbamazepine hiv pills fedex
<br />Where to purchase Carbamazepine 100mg cheap price no prescription Australia
<br />Order Carbamazepine overnight delivery
<br />Discount Carbamazepine buying online
<br /><ul><li>Where to purchase Carbamazepine 400 mg United States no doctor script</li></ul>
<br/><h2>low prices generic Tegretol in fort worth</h2>
<br />Online pharmacy cheap Carbamazepine online store
<br />Online Carbamazepine us
<br />Where to order cheap Carbamazepine no prescription
<br /><u>Carbamazepinee combo at amlwch</u>
<br />Carbamazepine canadian pharmacy
<br /><br /><br />Cheap sale Carbamazepine online no prescriptions overnight
<br />Order Carbamazepine overnight delivery
<br />Order Carbamazepine overnight delivery
<br /><br /><br />How to purchase Carbamazepine 100mg without rx online
<br />Buy Carbamazepine 100 mg
<br />Discount Carbamazepine order United Kingdom
<br /><i>Tegretol ordered online without prescription</i>
<br />buy online order Tegretol
<br />Low cost Carbamazepine 200 mg buy online England
<br />Carbamazepine online visa no prescription
<br />Discount Carbamazepine no prescription
<br />Order Carbamazepine 200 mg online mastercard
<br />Order Carbamazepine overnight delivery
<br />Purchase Carbamazepine 200mg USA online
<br /><b>Carbamazepine Rhondda</b>
<br />Carbamazepine antiviral in internet drugs overnight
<br />Order Carbamazepine overnight delivery
<br />purchase cheap discount online Tegretol
<br />Carbamazepine prescription dosage at ma
<br />Buy cheap Carbamazepine 400mg
<br/><h3>Discount Carbamazepine 400 mg buy without rx GB</h3>
<br />Order Carbamazepine 400 mg no prescription New Zealand
<br />Cheap price Carbamazepine 200 mg purchase online without rx
<br /><i>where to buy Tegretol in internet priority mail</i>
<br />Carbamazepine medication
<br />Order Carbamazepine without prescription to ship overnight
<br /><b>Purchase no online rx Carbamazepine</b>
<br />thiabendazole generic Tegretol
<br /><b>Buy cheap Carbamazepine c.o.d.</b>
<br />Get Carbamazepine over the counter fedex
<br /><br /><br />Consumer report on generic Carbamazepine
<br />Cheap Carbamazepinee eskalith-cr in internet pills no prescription
<br />Order Carbamazepine overnight delivery
<br />
This stuff goes on for a while; I’ve snipped most of it out. Pretty straightforward pharma spam. But look at the bits highlighted in yellow. This page was fetched from googl-analize.in masquerading as the compromised site sfpulpit.com, and scattered throughout the HTML that googl-analize.com handed back are links to other hacked WordPress sites. This is a black-hat SEO technique to boost the Google page rank of all the sites in the network, and it suggests that the Web site googl-analize.in is keeping a list of hacked sites.
The Google site: command is a good way to see whether or not your site has been affected by this attack. I still don’t know the attack vecotr, but at this point I’m about 90% sure that the hackers are gaining access to a Web site on a shared server, via an FTP brute-force attack or whatever, and then exploiting flaws in that shared server to attack other Web sites hosted on the same server.
Unfortunately, there’s little that a Web hosting customer can do to make sure that their hosting provider is following security best practices. You can harden our software by tightening up file permissions, but that is little defense if your shared server is compromised.
Gotta nit-pick a bit on your nit-picking of 4a. By definition,(outside of the ordinary, or not part of the accepted standard), any data that proved an extraordinary claim would be extraordinary evidence.
“Extraordinary claims require extraordinary evidence.” Is just another way of saying “If you’re going to claim something that doesn’t fit with the standard, you need to back it up with real evidence that wasn’t included in the creation of said standard.”
This is a little different from the way Tacit explained the phrase though, which usually changes the statement to some variation of “Astounding claims require astounding evidence.” Astounding, amazing, huge, and mind-blowing are not synonyms for extraordinary. Better fits would be unusual, uncommon, non-standard and distinctive.
Basically, if I’m reading you right, you disagree with Tacit’s explanation of the phrase, rather than the phrase itself. If that is the case, we’re in agreeance.
Someone making an extraordinary claim, such as the pyramid building alien idea Tacit mentioned, would not necessarily need “a whole lot of evidence”. A single piece of evidence, could suffice, if it stands up to scientific scrutiny. The “evidence” given by people making these claims does not pass muster, and this is where it fails.
This slides right into rule 4b. Any claim made should be based on the quality of the evidence supporting it, rather than the quantity.
Gotta nit-pick a bit on your nit-picking of 4a. By definition,(outside of the ordinary, or not part of the accepted standard), any data that proved an extraordinary claim would be extraordinary evidence.
“Extraordinary claims require extraordinary evidence.” Is just another way of saying “If you’re going to claim something that doesn’t fit with the standard, you need to back it up with real evidence that wasn’t included in the creation of said standard.”
This is a little different from the way Tacit explained the phrase though, which usually changes the statement to some variation of “Astounding claims require astounding evidence.” Astounding, amazing, huge, and mind-blowing are not synonyms for extraordinary. Better fits would be unusual, uncommon, non-standard and distinctive.
Basically, if I’m reading you right, you disagree with Tacit’s explanation of the phrase, rather than the phrase itself. If that is the case, we’re in agreeance.
Someone making an extraordinary claim, such as the pyramid building alien idea Tacit mentioned, would not necessarily need “a whole lot of evidence”. A single piece of evidence, could suffice, if it stands up to scientific scrutiny. The “evidence” given by people making these claims does not pass muster, and this is where it fails.
This slides right into rule 4b. Any claim made should be based on the quality of the evidence supporting it, rather than the quantity.
update on le hack-attack
User referenced to your post from update on le hack-attack saying: […] Then the followup: http://tacit.livejournal.com/362983.html […]
update on le hack-attack
User referenced to your post from update on le hack-attack saying: […] Then the followup: http://tacit.livejournal.com/362983.html […]
To this I would add that it’s not a binary position of “you can have coal or you can have nuclear.”
I know plenty of people who don’t like either. 🙂
In fact the argument that it’s binary is part of the industry rhetoric.
To this I would add that it’s not a binary position of “you can have coal or you can have nuclear.”
I know plenty of people who don’t like either. 🙂
In fact the argument that it’s binary is part of the industry rhetoric.
That thing that lets you write this lucidly even with jetlag – can you bottle it and sell some please?
Good journal, as ever – although I have to admit that my first thought on reading it was ‘Yay, Brighton!’ as that’s where I’ll be on Saturday 🙂
That thing that lets you write this lucidly even with jetlag – can you bottle it and sell some please?
Good journal, as ever – although I have to admit that my first thought on reading it was ‘Yay, Brighton!’ as that’s where I’ll be on Saturday 🙂
<3
You are beautiful.
Also, obligatory Tim Minchin reference:
http://www.youtube.com/watch?v=Gaid72fqzNE
xxx
<3
You are beautiful.
Also, obligatory Tim Minchin reference:
http://www.youtube.com/watch?v=Gaid72fqzNE
xxx
Hmmmmmm…. I foresee a whole new party game for kinky people.
“Spin the Knife”
🙂
(found the tardigrade!)
Hmmmmmm…. I foresee a whole new party game for kinky people.
“Spin the Knife”
🙂
(found the tardigrade!)