Analysis of a new WordPress attack

I run a number of WordPress sites. Running a WordPress site is an invitation to hack attacks; it’s such a popular platform that it provides an appealing target for hackers. On top of that, I have a somewhat tumultuous relationship with Eastern European organized crime that extends back quite a number of years (I’ve worked with law enforcement on high-profile attacks like this one), so I get a fair amount of attention from folks trying to DDoS, penetrate, or otherwise attack my sites.

The Attack

Last night, a hacker successfully penetrated one of the WordPress sites I own. I use a WordPress plugin called Word Fence that notifies me whenever anyone with administrator access logs in to one of my sites, so I responded and kicked the attacker out within eight minutes. Approximately fifteen minutes later, an attacker from the same IP address logged in to another WordPress site I run. I kicked him out of that site a few minutes later.

WordPress attackers often modify core WordPress files to install back doors, so I downloaded the contents of both sites, then did a nuke-and-pave with a new known-good WordPress install and moved the database to a different location.

I am still analyzing the attack, but there are a number of factors that have raised my suspicion that this may be a novel zero-day attack, not the least of which is the attacker gained access to both sites on the first login attempt without brute-forcing an administrator password (and yes, I use very robust passwords). Furthermore, the attacker logged in to an account named “admin,” and I do not create WordPress administrator accounts with that name–I always use different names for the admin accounts.

I’ve done a first pass forensic analysis of the attack. These are the characteristics I observed in both attacks:

  • The first thing the attacker does is create several new administrator accounts. These accounts have names such as “administrator;” “admin;” “admin” followed by a random two or three digit number (such as “admin52”); and “root.”
  • The attacker then creates new directories in the /plugins directory located in /wp-content. These directories are named “research_plugin_” followed by a random string of letters and numbers, such as “research_plugin_2hAs”.
  • Next, the attacker uploads malicious PHP files into these “research_plugin” directories. The PHP files are named “research_plugin.php”. Their content is located under the cut below.

Click here to see the content of the research_plugin.php file

Operation Choke Point; or, We Know What’s Best For You

Before I can really go into the things I want to talk about, I’ll need to offer you, dear readers, a bit of back story.

As many folks who’ve read this blog over the years know, I am, among many other things, a game designer. I’ve developed a game called Onyx, which I’ve maintained and sold since the mid-1990s. Onyx is a sex game. It’s designed for multiple players, who move around a virtual “game board” buying properties. When another player lands on your property, that player can pay rent or–ahem–work off the debt.

I sell Onyx on my Web site here. It’s lived there for many years, and for the past thirteen years or so, I’ve accepted credit card payments for the registered version of the game via a merchant account provider called Best Payment Solutions.

This past April, I received notification from Best Payment Solutions that they were terminating my account. They gave no reason, other than they “sometimes terminate accounts for risk reasons.” In the thirteen years I’d been with them, I’d only had one chargeback–a rather remarkable record I doubt few businesses can match. Didn’t matter.

I was told that BPS would no longer work with me, but their parent company, Vantiv, would be happy to give me a merchant account. Vantiv’s underwriters, I was told, had looked at my Web site and had no problem with its contents.

So i did the requisite paperwork, turned it all in, and…nothing. For weeks, during which time I was effectively out of business.

Then, four weeks later, I heard back from Vantiv. We’re so sorry, they said, we thought we could give you a merchant account, but we can’t. When I asked why, the only thing they would say was “risk reasons.”

Thus ensued a mad scramble to find a new merchant account underwriter, a process that’s normally very time-consuming and tedious. I finally found another underwriter, which I will decline to name for reasons that will become obvious once you read the rest of this post, and I’m back up and running again…but not before I was out of business for over a month.

Onyx registrations pay my rent, so as you might imagine, this has been a stressful time for me.


Okay, that’s the backstory. A sad tale of a merchant account underwriter that got cold feet for no clear reason, I thought. Annoying, yes, stressful, you bet. But one of those things that just kind of happens, right? Banks make business decisions all the time. So it goes.

It turns out, though, that I’m not the only one this has happened to. Indeed, it’s happened to lots and lots of people. The same pattern, across different businesses and different merchant account providers: A business receives a sudden notification that their merchant account (or in some cases, their business checking account) is being terminated. When they ask why, no answer beyond “risk reasons” is forthcoming. Porn performers, payday loan services, dating sites, fireworks sellers, porn producers, travel clubs…it’s a very specific list of folks who are having this problem. And, not surprisingly, there’s a reason for it.

The reason is the Department of Justice, which for the past couple of years has undertaken a project they call Operation Choke Point.

The goal of Operation Choke Point is to pressure businesses in morally objectionable fields out of business, by leaning on the banks that provide services to those businesses. If you can’t get banking or credit card services, the reasoning goes, you can’t stay in business. So the DoJ is approaching commercial banks, telling them to close accounts for individuals and businesses in “objectionable” industries.

It should be noted that the businesses being targeted are not breaking the law. Lawful businesses and individuals are losing access to lawful services because the government objects to them on moral grounds.

The banks being pressured to close accounts are reticent about talking about it; however, one business owner, whose instincts were in the right place, apparently managed to get a recording of a phone call in which his merchant account processor (EFT) told him they were pressured by the government to close the account. His recording has made it to a Congressional hearing looking into the program. (Some banks have reported being told that they would be investigated for racketeering if they failed to close accounts belonging to targeted businesses, despite the fact that the targeted businesses are acting lawfully.)

There’s a backlash brewing. Congress is starting to hold hearings about businesses targeted without due process. The DoJ has backtracked. The FDIC, which was involved in pressuring banks to terminate targeted businesses, has reversed course. All that is good. And yet…and yet…

I can’t help but think the backlash isn’t because people really believe the program was wrong, but rather because it included one industry that is considered politically sacrosanct by the Obama administration’s opponents: guns.

In addition to adult businesses, Operation Choke Point targeted small gun and ammo retailers. And there’s a small, cynical voice inside my head that whispers, if they had contented themselves with going after people like me–people who make or sell things related to sex–would anyone have cared? The right-wing blogosphere is filled with angry rants about Operation Choke Point, as well it should be…but none of the angry rants mention adult businesses or porn. They all focus on guns. And I just really can’t make myself believe that the people rising up against the program have my interests at heart. If it were just me, I believe we wouldn’t hear a peep out of them.

Don’t get me wrong–for once in my life, I’m glad the Republicans are taking action about something. But I hold no illusions that next time, they will still have my back.


By the time all was said and done, I lost somewhere around $700 from the problems I had. Not a lot, really, in the scheme of things, though I did have to scramble to make rent this month. It could have been worse.

I know there are a lot of folks in various adult-related businesses who read my blog. I’d really love to hear from you guys. Has this happened to you, or anyone you know? What was the outcome? Let me know!

Help make the world a sexier place!

I have a friend named Emily Bingham. She’s a rope bottom and a fetish model, and if you’ve read this blog for a while you’ve doubtless seen photos I’ve done of her, like the ones of her tied up in the ruins of an old house I posted here (link is not safe for work, of course).

What you might not know is she’s also a writer, and a damn good one at that. She’s one of the top erotica writers on Amazon (under a pseudonym), and now she’s launching a new project: a true memoir of her experiences and adventures in rope. The book is long, and covers thirty stories, some of them funny, some of them sexy, some of them heartbreaking.

And she needs your help.

Emily is running a crowdfunding campaign to finance the memoir. I’ve been lucky enough to see an early version, and it’s awesome. I highly encourage you to check out her crowdfunding and help support it.

It’s an important book. It covers the ups and downs–sex, erotica, assault, consent–of life in the world of BDSM, and does it unflinchingly and with absolute candor. It’s the kind of book we need if we’re going to help move the BDSM community in the direction of ethics and consent.

And did I mention it’s sexy?

Please, check out the crowdfunding. If it appeals to you, support it.

Massive Linky-Links

I have once again reached the point where there are so many tabs open in my browser that my computer’s performance is suffering. It’s time for a purge, and you all know what that means: a list of links for your edification and amusement!

Society and Sexuality

Nebraska woman files Federal lawsuit against all homosexuals
Sylvia Driskell, a self-described “ambassador for God,” has filed a lawsuit against all homosexuals on the grounds that God has said homosexuality is an abomination. Honestly, I feel a little sorry for her.

Police: Fraternity dosed women with date-rape drugs at party based on color-coded hand stamps
The horror show that is the American university fraternity system just never stops.

Nonmonogamy for men: the big picture
Men who are new to the idea of non-monogamy make a lot of mistakes and often have a lot of trouble finding partners. Here’s a cogent analysis of why, and how not to make those mistakes.

Informatics: What an analysis of one million sex toy sales tells us about our erotic tastes, kinks, and desires
Two of my favorite things (sex and informatics) in one place! This is an awesome article.

So you’re not desirable…
Article by the authors of a paper recently published in the Journal of Personality and Social Psychology that suggests who you are–your uniqueness–is more valuable to prospective partners than traditional markers like physical attractiveness or money. Seems the advice “be yourself!” now has scientific evidence behind it.

What happened when I posed as a man on Twitter
You know how women say they get a lot of shit that men don’t get on social media, and men say naaw, women are just exaggerating ’cause they’re all thin-skinned and emotional and stuff? Surprise, surprise, it turns out women actually do get more shit on social media.

Science

Scientific American: Alien Supercivilizations Absent from 100,000 Nearby Galaxies
Dyson spheres and other huge-scale macroengineering projects should be visible from earth even if they are located in distant galaxies. But we don’t see any sign of them. Where is everyone? (I’ve written a bit about the Fermi paradox in this blog here.)

Random Strangeness

Photographs of superheroes wearing “outfits” made of milk–and nothing else
Just what it says on the tin. Probably not safe for work.

Software engineering, now with cats
How modern software engineers would design a cat. As a computer programmer, this is, I can attest, altogether too true.

Every noise at once
Comprehensive clickable interactive map of every kind of music you can imagine.

And finally, there’s this gem from YouTube: a lovely hand-crafted 2-stroke engine with a transparent combustion chamber so you can see the fire.

eAffiliate Marketing Spam: How It Works

A short while ago, I blogged about why I’m moving off Namecheap as my domain registrar. In the past six or seven months, I’ve received a tidal wave of spam advertising domains hosted on Namecheap, and their abuse team has proven to be remarkably incompetent at dealing with the problem.

The flood continues unabated. Diet pills, life insurance quotes, ultra-right-wing conspiracy sites, Home Depot windows…everything and anything you can imagine getting spam for, all of it advertising Namecheap-hosted sites.

I’ve been logging all the spam, and doing a bit of digging. The Namecheap domains are being registered at a fantastic clip, scores a day, each one used in spam runs for perhaps 24 to 48 hours before being rotated to a new one. And, interestingly, the domains are all registered in the clear rather than through a privacy service, so the registrant information is plainly visible.

These domains–scores and scores and scores of them–all have the same information:

whois healthybodynewletter.us
Domain Name: HEALTHYBODYNEWLETTER.US
Domain ID: D49677935-US
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrar URL (registration services): whois.enom.com
Domain Status: clientTransferProhibited
Variant: HEALTHYBODYNEWLETTER.US
Registrant ID: 377EE235E374635C
Registrant Name: Coloplatinum Hosting Coloplatinum Hosting
Registrant Organization: Coloplatinum Hosting
Registrant Address1: PO Box 96503
Registrant City: Washington
Registrant State/Province: DC
Registrant Postal Code: 20090
Registrant Country: United States

A quick Google search for “Coloplatinum Hosting” turns up this page on Spamhaus. Coloplatinum Hosting is one of many business names used by a well-known and extremely prolific spammer named Mike Boehm.

I kept digging, using programs like wget to visit the Spamvertised domains. The links in the spam emails lead to domains hosted by Namecheap Hosting, which redirect to click-trackers hosted by various affiliate marketing companies, which in turn redirect to the actual spam sites–and there are zillions of them. Mike Boehm is a busy guy, and he will spamvertise anything. Amazon and Walmart gift cards. Laissez Faire Books, a right-wing Libertarian book store. Fundamentalist end-of-days Web sites. Quack “medicine” sites offering to cure diabetes, make you slim, and protect you from heart attacks. Woodworking sites. There is, it seems, just about nothing he won’t spam.

I spent some time mapping out his spam network. It looks something like this:

I’ve received tons of spam from him in the past, using domains hosted all over the place. These days, he has chosen Namecheap as his registrar and host of choice; all the spam I’m receiving from him is currently hosted by Namecheap.

He is using three affiliate advertising tracking companies: Flex Marketing Group, Clickbank, and Clickbooth.

I’ve reached out to all three companies with spam reports. Clickbank has generally been pretty good about shutting down his affiliate codes, but they’re not good at being proactive; in two or three days, he spamvertises more domains with fresh new Clickbank affiliate IDs.

Flex Marketing Group has what is on paper a very tough anti-spam policy. In practice, it’s totally bogus. They have responded to email spam complaints by blocking me on social media, but haven’t done anything else.

Clickbooth appears to be a “listwasher”–a company that assists spammers by removing the email addresses of people who complain about spam. Legitimate companies don’t support spammers. Listwashers support spammers, permit spam, and assist the spammers in removing email addresses of people who are likely to complain about spam:

EDIT: The day after this post went live, I received the following email from Clickbooth:

Dear Franklin,

Thank you for your email. Please be advised that adding email addresses to suppression lists is only one of the actions taken in response to spam complaints. In the case referenced in your recent complaint, additional action was taken and the affiliate account was terminated. If you have additional questions about Clickbooth compliance our full set of guidelines may be found here: http://support.clickbooth.com/support/solutions/folders/146482.

So it appears Clickbooth is indeed proactive about dealing with spammers. Score one for the good guys!

The affiliate marketing companies then redirect to the actual sites, and in the process generate money for the spammer.

The flow of money looks like this:

Namecheap appears to be getting a reputation for supporting spammers. I looked at their Wikipedia entry, and it has this line (and no, I didn’t write it; I don’t even have a Wikipedia account):

It’s not hard to see why. Mike Boehm spends a lot of money on domain registrations, buying them by the dozens. Each one is used in one or two spam runs. Namecheap eventually shuts them down, sometimes, after weeks or months have gone by, but in the meantime he’s registered way more. Based on the number of spam emails I’m receiving, typically 16-22 per day 5 days a week, and the type of registration (.us domains are currently his favorite), Namecheap is making at least $24,000 a year from him. That’s a conservative estimate; I probably don’t personally receive examples of every one of his spam runs.

So it’s no surprise that Namecheap is slow to close his domains, and reluctant to do so. They consistently find all kinds of excuses not to disable all the spam domains he uses. Here are some emails I’ve received from Namecheap, typically a month or so after I file a spam report:

Well, yes, he isn’t sending the spam emails themselves from the spamvertised domains; almost no spammers do that.

Apparently, Namecheap waits for anti-spam services to blacklist a domain before they’ll suspend it…by which time the spammer has long since moved on to advertising the next domain.


This spam system depends on the cooperation of a number of different people and organizations, some of whom are actively or tacitly complicit, others of whom are likely completely ignorant.

Companies like Walmart, T-Mobile, Amazon, Home Depot, and others probably don’t know they’re supporting a spammer. They set up affiliate programs with affiliate network companies they believe to be reputable, and naively don’t pay close attention to how those affiliate programs are run.

Companies like Flex Marketing are more actively complicit. They receive money for every click or every purchase from the affiliate marketers–you get a spam email advertising new windows from Home Depot or offering life insurance quotes from Fidelity Life, click the link, and those companies pay money to Flex Marketing or Clickbooth or Clickbank. Flex Marketing, Clickbooth or Clickbank then pay some of that money to Mike Boehm for the referral.

The affiliate marketing companies–Flex Marketing, Clickbooth and Clickbank–are aware of what’s going on, but take action only after spam is reported (Clickbank) or not at all (Flex Marketing).

Of course, the less reputable sites–the ones selling fake heart attack medications, phony diabetes cures, videos about the coming Apocalypse, books on how the US government is planning to kill all the Christians, gambling sites, and so on–are absolutely aware they’re being advertised by spam, and they don’t care. (The fact that companies like Flex Marketing, Clickbooth and Clickbank accept them as customers is pretty telling.)

So Namecheap hosts spam sites, affiliate marketing companies monetize the clicks on spam emails, some of that money goes to the spammer, and some of that money is retained by the affiliate marketing companies. The money ultimately comes from legitimate businesses such as Home Depot and T-Mobile or fringe sites selling fake medications or online gambling, who get it from people who sign up for their services or buy their products.

I have reached out to the companies who support this particular spammer by email and social networking and invite their comments on this entry.

Namecheap: Why I’m moving away from them

I have a rather extensive collection of Web sites, where I write about everything from photography to transhumanism to sex. As a result, I have rather a lot of domain names, which until recently I’ve registered with Namecheap, as they have in the past been cheap and reasonably reliable.

However, I have begun the painful and expensive process of moving off Namecheap, and I recommend others do the same. There are two interrelated reasons for this, the first having to do with poor support and training (Namecheap employees don’t appear to know the differnce between a domain and a subdomain, which is rather a serious problem when you’re in the business of domains) and the second having to do with support for spam and malware (largely on account of the first).

The story is long and complicated, but it begins many months ago with a spam email advertising life insurance, which was plugging a domain hosted on Namecheap Hosting.

Namecheap, in addition to being a domain registrar (well, technically a reseller for a registrar called Enom), is also a Web hosting company. If you’re a Web hosting company, sooner or later a spammer will host a Web site with you. How you react when you receive abuse reports will determine how popular you are with spammers. If you react quickly, spammers will avoid you. If you allow the site to remain up, spammers will talk, and soon other spammers will flock to you. If you continue to leave spam domains up, pretty soon spammers will start choking out your other customers.

Anyway, it happens. A spammer found Namecheap Hosting. I hadn’t seen much spam on Namecheap before, so I fired off an abuse report and that was the end of it.

Or so I thought. But then things took a turn for the strange.

A couple of days later, I received an email from Namecheap abuse saying “we aren’t hosting this domain, go complain to someone else.” Now, that happens from time to time as well; spammers will sometimes hop from one host to the next, so by the time a host receives a complaint, the spammer’s Web site has been moved and they’re not hosting it any more.

I looked at the domain. Still hosted on Namecheap. I wrote back saying “no, it’s definitely hosted by you guys; here’s the IP address, 162.255.119.254. That address is in your space.”

And got back a second email: “We’re not hosting this site.”

“Huh,” I thought, “that’s strange. Maybe the site is hosted on many IP addresses?” That’s another spam tactic, putting a Web site on a bunch of hosts and then changing the IP address constantly. But no, the site had only ever been hosted by Namecheap.

I replied and said “no, here’s the DNS entry, ere’s the history for the site, you’re definitely hosting it.” And got back yet another reply: “no we’re not.”

And then something even weirder happened.

I started getting tons of spam advertising domains pointing to Namecheap’s IP address space. Tons. Spam advertising life insurance, promoting Bitcoin schemes, advertising phony “cures” for diabetes. Spam pitching window replacement services, Amazon gift cards, Russian dating sites, and home refinancing.

And I’d seen this spam before. It was word-for-word and image-for-image identical to spam from well-known, infamous spam purveyors that had always, until now, advertised sites hosted in Russia, Columbia, and the Ukraine–places that tend to permit spam hosting.

I started getting multiple pieces of this spam a day. Then dozens. All of it advertising domains on Namecheap IP addresses.

  
Left: Old spam advertising a site hosted in Eastern Europe. Right: Recent spam advertising a site on Namecheap.

I sent spam reports to Namecheap…and Namecheap’s abuse team kept sending responses saying “we aren’t hosting these sites.”


This is the point where I learned that Namecheap, a company that sells domain names, does not understand how a domain name works.

A typical domain name has three (or more) parts. The parts are separated by periods. Let’s look at an example:

www.morethantwo.com

Going from right to left: The last part is called a “top level domain,” or “TLD”. It’s things like “.com” or “.net” or a country-specific code like “.ca” (for Canadian sites). The UK uses “.co.uk” for various historical reasons.

The part before the TLD, in this case morethantwo, is the domain name.

The part at the very beginning, in this case www, is a subdomain. The subdomain “www” stands for “World Wide Web” and it’s the most common subdomain by far. But you can make a subdomain be anything you want. You could set up your Web site at “polyamory.morethantwo.com” or “groupsexisawesome.morethantwo.com” or anything else you like.

And here’s the important part:

You can put a subdomain on a completely different server, hosted by a completely different Web host.

For example, morethantwo.com is hosted by Incubus Web hosting. But if I wanted to, I could put “polyamory.morethantwo.com” on Dreamhost and “groupsexisawesome.morethantwo.com” on Softlayer–each subdomain can get its own IP address and its own Web server, if you want.

Now you might not know that, and you can be excused for not knowing that. It’s not necessary to understand how the Internet works in order to use it.

But Namecheap should know that. They sell domain names. This is what they do.

It’s okay if a person who owns a car doesn’t know that a car’s engine has more than one spark plug in it, but no professional mechanic should ever be ignorant of that simple fact. It’s okay if a person who uses the Web, or even a person who owns a Web site, doesn’t know that subdomains can be hosted on one IP address. It’s unforgivable that a domain registrar doesn’t know that.

In this case, the spammer is using domain names that look like

view1.gnrlbshomes.us

“view1” is a subdomain, hosted by Namecheap. The main domain,gnrlbshomes.us, is hosted elsewhere. Namecheap’s abuse team doesn’t know how that works. When they received the spam complaint, they didn’t look at view1.gnrlbshomes.us, they only looked at gnrlbshomes.us.

When I figured out what was happening, a light dawned. I fired off a reply explaining that view1.gnrlbshomes.us and gnrlbshomes.us were hosted at differnt IP addresses, and they were hosting the actual spamvertised URL, view1.gnrlbshomes.us.

Problem solved, right? They simply missed the subdomain, right? Wrong.

Elena, it seems, didn’t talk to Kate. Namecheap has a systemic problem. This isn’t someone not noticing the subdomain, this is someone not knowing how domains work.

And I got a lot of these emails, from all different people: “The domain ‘blah blah blah’ isn’t hosted by Namecheap.”

At this point, I was convinced the problem was incompetence…and a bizarre incompetence, an incompetence on the level of a professional auto mechanic not understanding that an engine has more than one spark plug.

But then, things took a turn for the even weirder.

I patiently replied to each of the emails, showing the IP address of the main domain and the subdomain, and that the subdomain was in fact on Namecheap IP space.

And then I started getting replies like this:

Essentially, what this says is “if you don’t actually send email from a Namecheap server, you’re welcome to spam a domain that lives in Namecheap space and we’re A-OK with that.”

Now, spammers almost never send emails from the same servers their Web sites live on. Usually, spammers send emails from home computers that are infected with viruses without their owner’s consent (a lot of computer viruses are written for profit; the virus authors infect computers with software that allows them to remotely control the computers, then sell lists of infected computers to spammers, who use the infected computers to send spam email.) Sometimes, the spam emails are sent from “bulletproof” spam mail servers in places like the Ukraine. But they almost never come from the same computer that’s hosting a site.

So Web hosting companies want to see a spam with full headers when you report spam, so they can verify that, yep, this is a spam email, and shut down the Web site that’s being spamvertised.

But not Namecheap. Namecheap will knowingly and willingly allow you to spam domains on their servers, provided the spam email doesn’t actually come from the same server.

I asked if their policy was to permit spam that doesn’t originate from the same server as the Web site, I received this reply:

Which to me looks like a “yes.”

At the moment, I am currently receiving 11 spam emails a day advertising domains that resolve to Namecheap IP addresses. There are about half a dozen products being spamvertized; each day’s crop of spam messages are word for word and image for image identical to the previous day’s, but the domains are different. Clearly, the spammers feel they’ve found a good home in Namecheap.

So I took a look at that IP address, 162.255.119.254. It’s quite a mess.

Domains on 162.255.119.254 are all forwarded; that is, 162.255.119.254 is a pass-along to other IP addresses. If you want to put up a Web site and you don’t want anyone to know who’s really hosting it, you can put it there, and visitors will be invisibly passed along to its real home.

Now, can you guess what sort of thing that’s useful for?

If you said “spam and malware!” you’re absolutely right. A Virustotal analysis of 162.255.119.254 shows that it’s being used to spread a lot of bad stuff:

And it’s not just Virustotal. A Google search for 162.255.119.254 shows that it has a reputation as a bad neighborhood in a lot of places. It’s listed as a bad actor in the Cyberwarzone list:

and as a virus distributor in the Herdprotect list:

At this point, I got tired of making screenshots, but basically this Namecheap server has a bad reputation everywhere.

So whether through gross incompetence or active malice, Namecheap is running a server that’s a haven for spammers and malware distribution.

Which is why I’ve begun pulling my domain name registrations from them. I can not in good conscience spend money to support a company that’s such a menace to the Internet, and I spend about $500 a year in registrations.

Now, interestingly, I’m averaging about 11 spam emails a day advertising domains on Namecheap’s IP space, but I’m averaging 20 spam emails a day that are word for word identical to these but aren’t advertising a domain on Namecheap.

The ones that are advertising domains not on Namecheap are advertising domains hosted by a company called Rightside.co, a Web host I’m not familiar with.

As I mentioned before. Namecheap is a reseller for a registrar called Enom. And Rightside.co, well…

The fact that the same spammer is using Namecheap and Rightside, and they’re both front-ends for Enom, is interesting. Stay tuned!

“Most likely a sociopath”

As many folks who read me probably know by now (and goodness, I’m doing my job wrong if you don’t!), I’m polyamorous. I’ve been polyamorous my entire life, I’ve been writing a Web site about polyamory since the 1990s, and I recently co-wrote a book on the subject.

A lot of folks ask me if I get negative responses from being so open about poly. And the answer is, no, I usually don’t. In fact, it’s extremely rare that I hear anything negative about polyamory, all things considered. I generally encourage folks who are poly (or in other non-traditional relationships) to be as open as they feel safe in being, both because stigma is reduced when many people are open about non-traditional relationships and because, almost always, the pushback is nowhere near as great as people are likely to think it will be.

But that’s not to say I never hear anything negative. Like this, for example, left as an anonymous comment to a post I made about dating and relationships on a social media site recently:

“This is what a woman had to say about you “Let me put this franklin, frank is a user/manipulator. I am sure he tells the women he is with that by being in a relationship with him and 4 other women that he is “empowering” them. You have to realize that there is a new “modern” type of feminism, these women misconstrue the term femism. The original feminist wanted to feel equal to men, they wanted more opportunities that we (women) are now given due to thier efforts. Nowadays women are empowered in a completely different way, women are mislead (in my opinion by manipulative men such as franklin) to believe that being overtly sexual is empowering, so that is why you see these women bending over backwards for men. I dont know exactly who is misleading women of our generation to believe polyamory is empowering or being overly sexual is but its someone, perhaps the feminists in the media but the question who is behind the media in the first place? I just feel bad for young feminists because they have no true understanding of what it means to be empowered and they are very confused. Franklin is smart and manipulating each girlfriend he has and he most likely a sociopath.””

Formatting, quote marks, and spelling as in the original.

So now you know, the media feminists are pushing women into the arms of sociopaths like me. Curses, my secret is out.

The Game Changer: A Memoir of Disruptive Love

This entry is cross-posted from the More Than Two blog. Feel free to comment here or over there.

gamechanger-finalFinally, after incredible struggle, the manuscript for my memoir The Game Changer is finished and in copyediting. You can preorder it now on Amazon.

Writing this book has been one of the most difficult things I’ve ever done. I’ve been thinking of it as The Big Book of Franklin Gets It Wrong, because it tells the story of the most awful things I have ever done, the greatest mistakes I’ve ever made, and the various ways I’ve hurt people close to me in the quest to figure out how to make this whole polyamory thing work. It’s been written and re-written and re-re-written (I went through four complete drafts and numerous smaller revisions and edits, prompted in large part by the incredible support and comments I’ve received from people who looked at the early versions).

Writing this book meant reliving some of the most painful times in my life. Along the way, I had to wrestle with my first-ever feelings of imposter syndrome (“Who am I to be writing a memoir? Who’s going to care about the relationships I screwed up?”), with feelings that I wasn’t good enough to write this book (it is radically different, in style, tone, and content, from anything I’ve ever written before), and with my own inner demons: my guilt and shame over the people I’ve hurt and the things I’ve screwed up.

In the end, I wrote this book because I believe there’s an elephant in the poly living room, a great gray pachyderm we don’t often acknowledge. We like to say that one of the biggest benefits of polyamory is we don’t have to choose; when we connect with someone new, that connection doesn’t have to threaten our existing relationships. Indeed, some poly folks look down on those benighted monogamous heathens, those poor struggling savages who aren’t yet enlightened enough to realize that a new love doesn’t have to mean discarding the old.

But sometimes, we connect with someone new, and that person changes things. Or changes you. Love is not always safe, or tidy, or neat. Sometimes, it’s disruptive. Sometimes, a new love makes us realize that our existing relationships no longer work for us.

These relationships are game changers.

Game changers, by their very nature, create turmoil. Game changers upset applecarts. And we, as polyamorous people, need to be aware that game changers happen.

My first game-changing relationship showed me that for years, the compromises I had made to be with a monogamous partner were damaging to the people around me. I was both easy to love and dangerous to love. I did not think about the consequences of my agreements for new partners who might want to be close to me, and I did not recognize the ways I failed to take responsibility for my own emotions or actions. And so, predictably, I hurt other people—people who loved me very much.

The Game Changer is a love story, but it’s also more than that. It’s the story of how I learned to be honest about my needs, to recognize that other people are human, and to take responsibility for myself.

It’s also the story of things I did very, very wrong.

It is still, years later, hard for me to deal with some of the things I got so badly wrong, and the damage I did to people who loved me. Maybe, just maybe, other people will read this book and be a little bit less wrong, a little bit more compassionate, in the way they handle their game changers.

GMohno! Part 2: Food safety

It’s much too early in the morning. You stumble blearily out of bed and put on the hot water for a nice cup of tea, or perhaps flip on the percolator to brew some coffee. Unfortunately, your morning beverage is laced with a poisonous chemical that keeps the crop from being eaten by insects–an insecticide that is toxic not only to bugs, but to humans too.

You go out to lunch. The server recommends the rainbow salad, which unknown to you, also contains a number of insect-killing chemicals. Your workmate from across the hall–you know, the one who always plays the stereo too loud and makes that weird snorting sound when he laughs–skips the salad in favor of a nice, healthy ginger tofu with peanut sauce. Sounds healthy? It, too, contains pesticide chemicals, even though there’s a little “organic” sticker on the menu right next to it.

Sound scary? We’ll come back to that in a bit.


One of the objections that people have about GM food is the idea that it’s intrinsically less healthy than normal or organic food. Fears about health and food safety are sometimes hysterical, as when Zambian president Levy Patrick Mwanawasa banned all GM food imports and destroyed donated food over GM fears in 2002, even though his country was facing a famine and millions were at risk of starvation, and sometimes more muted, as when people try to link GM food to cancer.

Food safety is absolutely a legitimate and valid concern. Imagine, for instance, what people might reasonably say if a strain of genetically modified zucchini were linked to widespread cases of illness. In our hypothetical example, if it were shown that something intrinsic to the zucchini–not an insecticide or herbicide the zucchini had been modified to resist, but a compound actually produced by this strain of zucchini itself–sickened people, we might expect that folks would voice some concerns about the safety of genetic modification.

And that would be a perfectly reasonable thing to do.

This hypothetical case isn’t actually hypothetical. In 2003, a number of people in New Zealand were hospitalized by an outbreak of food poisoning linked to zucchini. Environmentalists jumped on the story, quick to point out the dangers of untested genetic engineering of food.

Problem was, it turned out the zucchini in question wasn’t genetically modified. In fact, it was organic–a fact that quickly caused the environmental groups to fall silent.

Plants are complex factories that produce staggering numbers of chemicals. Because plants can’t run away from hungry insects, they have evolved a formidable arsenal of chemical weapons designed to kill insects that try to feed on them.

In 2003, New Zealand experienced a severe aphid infestation. Conventional farmers who controlled the bugs with synthetic pesticides grew crops that were unaffected by the infestation. Organic growers, however, didn’t deal effectively with the aphids. The organic zucchini that survived the infestation produced large quantities of cucurbitacin, a toxic chemical zucchinis and other plants (like pumpkins and gourds) use to defend themselves from pests. The organic zucchini with elevated levels of cucurbitacin contained so much of the chemical it was toxic to humans as well, hospitalizing people who ate it.

Something similar happened in the 1960s. Farmers using conventional breeding techniques bred the Lenape potato, cultivated to fry without burning and make perfect potato chips. Unfortunately, potatoes belong to the same family as deadly nightshade, and like nightshade, they are toxic. Potatoes produce a glycoalkaloid poison called solanine, which is extremely toxic to humans–quantities as small as 3 mg per kg of body weight can be fatal. (That’s crazy poisonous, by the way.)

All potatoes produce this toxin. The potato root contains solanine, but not usually enough of it to cause health problems–it’s the dose that makes the poison, after all. But the Lenape potato had elevated levels of solanine–enough to sicken people who ate it.

And it wasn’t GMO. It was an ordinary hybrid bred through conventional agriculture.


So, back to the beginning of this post. When you drink tea or coffee, you are consuming a toxic chemical that belongs to a class of chemicals called cyclic alkaloids. This toxin, evolved as a defense against marauding insects, is a neurotoxin called 1,3,7-Trimethylxanthine, or more commonly, “caffeine.”

And your lunch? The peppers in it contain capsaicin, a toxin that gives peppers their characteristic burning (and are also linked to cancer in animal studies). Such compounds exist all over nature–the wonderful aromatic smell of ginger, the sulfur compounds that flavor onions and leeks (and also make your eyes burn when you chop them)–all toxic chemicals that exist for their pesticide properties.

People who object to GMOs on food safety grounds tend to ignore the fact that any food potentially carries risks. Proponents of GMOs do not claim that GM food is always absolutely safe under all conditions; such a claim would be very silly indeed. GM food simply isn’t inherently any more dangerous than organic or conventional agriculture, that’s all. (In fact, if you judge strictly by cases of food recalls and documented foodborne illnesses, organic food is arguably the most dangerous of all broad classifications of food; it’s disproportionately represented in FDA food recalls for potentially health-threatening contamination, for example.)


One of the many organic foods recalled in the last 60 days because of potentially life-threatening contamination.

What makes GM food so much more frightening than other food, even when we know other types of food are more prone to dangerous contamination?

A lot of it is the same kind of fear that makes flying seem more scary than driving, even though the reality is exactly the opposite. We feel more familiar with driving. We feel more in control. Few people understand basic biology; fewer still understand agricultural science. Scientists overwhelmingly believe GM food is safe; laypeople don’t. Indeed, ignorance of basic science is so common in the US that many people don’t know what DNA is, and at least one poll has suggested that there are large numbers of folks who think that genes are only found in genetically modified food!

That ignorance leads to a common cognitive error called the appeal to nature–the notion that genetically modified food is “unnatural” and therefore intrinsically worse than organic or conventional food, which is more “natural.”

This cognitive error is inevitably on parade in almost any argument against GM food:


Not all objections are quite that uninformed, of course. Of the arguments that don’t boil down to “unnatural=bad, natural=good,” many of the health concerns about GMOs center around two things:

1. Concerns about pesticides such as glyphosate; and
2. Concerns about allergens.

A great deal of noisy press has been generated by the WHO’s classification of glyphosate as “possibly carcinogenic.” This classification is based on a study that shows that people who handle large amounts of glyphosate, a key ingredient in Roundup, might be at greater risk of a form of cancer called non-Hodgkin lymphoma. Strangely, the same study showed such people to be at lower risk of many other forms of cancer. Here’s the experimental data:

So what should we make of this? That Roundup causes some cancer and cures other cancer?

It’s not that simple. there’s a good writeup over here, but the TL;DR version is: The data make no attempt to control for confounding factors. These are “case control” studies (studies that compare people who have cancer with people who don’t, and look for differences between the groups) rather than “cohort” studies (studies that track people for long periods of time, note and isolate potential risk factors, and then observe the relative incidence of cancer).

Another issue is that food isn’t like, say cigarettes. We can eliminate cigarettes; I’ve never smoked in my life. We can not, however, stop eating. So we can’t look at an isolated risk factor for some kind of food production technique without comparing it to the risk of other food production techniques, because we all have to eat!

And when we do that, we discover that there’s not only no increased risk with GMO food, but in fact organic and conventional agriculture often uses more dangerous chemicals and more risky growing techniques. As I noted in Part 0 of this series, for instance, many people wrongly think that organic food is grown without pesticides. In fact, organic food is grown with pesticides, and those pesticides are often more toxic than synthetic pesticides.

One pesticide used by organic farmers is rotenone. It’s strongly linked to Parkinson’s disease, and its use is banned in California. It should be noted that the same WHO body that classified glyphosate as a possible carcinogen also classifies rotenone as a moderate toxin–a more severe classification than glyphosate. In 2006, the FDA revoked approval for use of rotenone on food. In 2007, under lobbying pressure from organic growers, the FDA allowed use of rotenone as a pesticide in food production. Rotenone and other “natural” pesticides are often found in high concentrations in organic foods, especially organic olives and olive oil.

There’s something really interesting going on here. If the FDA had revoked permission to use a synthetic herbicide like glyphosate, then reversed direction under lobbying from Monsanto a year later, it’s quite likely that anti-GMO activists would be quite upset and vocal about it. Strangely, they’re silent about it when it’s an “organic” pesticide, even though it’s linked to human health hazards and residues are found in organic foods.

This is similar to the lack of reaction when organic zucchini were found to be hospitalizing people, even while environmentalists made quite a lot of noise when they wrongly believed the zucchini in question was genetically modified.

To my mind, this demonstrates conclusively that it’s not evidence of harm that’s the motivating factor in resistance to GMOs. Opponents aren’t motivated by analysis of evidence; they ignore things that apply to conventional or organic agriculture that they use as arguments to oppose GMOs. So the arguments themselves are validations, but aren’t the real reason for the opposition.

The other argument often used against GMOs is the allergy argument. GMOs are genetically modified to express proteins that aren’t found in the unmodified plant, the reasoning goes. Novel proteins in plants can potentially be allergens. Therefore, GMOs might provoke dangerous allergic responses.

It’s a legitimate concern, and contrary to common isperception, GM food is rigorously screened for potential allergens and development is discontinued if a new allergen is discovered. While any food can potentially cause an allergic response, novel allergens are taken very seriously by agricultural researchers.

Organic and conventional agriculture is not screened for potential new allergens. The development of hybrids and the use of mutagenesis, both of which are common in conventional agricultures, certainly can create novel proteins and novel allergens–yet only GM food is tested, conventional and organic food is not.

But the assumption that a GM food must contain some new protein, like the assumption that GMOs are any foods that contain DNA from a different species, is based on a profound misunderstanding of what a GMO is.

Some GMOs contain nothing new, either from another species or from anywhere else. The Arctic apple, for instance, is an example of a GMO made by turning off an existing gene, rather than adding a new gene.

Arctic apples are a breed of apples that don’t turn brown when they’re cut. There’s a natural breed of grapes called Sultana grapes, which are used to make golden raisins. These grapes don’t oxidize on exposure to air. Researchers noticed they had a natural mutation that silenced a gene–one of the same genes that Apples have. So, they reasoned, switching off that same gene in an apple might cause the apple not to turn brown. And they were correct.

The tearless onion is another example of a gene-silenced modification. Onions naturally produce various sulfur compounds to poison insects. One of these creates sulphuric acid–battery acid–on contact with water. When you cut an onion, this chemical is released into the air; when it comes in contact with your eyes or nose, it produces acid, which results in the pain and tears you feel. No-tear onions have the gene that produces this chemical turned off. It’s difficult to understand the objection to this kind of genetic modification. There’s no rational mechanism for harm caused by turning a gene off.

The fact is, we’ve now been eating GM food for a very long time, with no evidence whatsoever of harm. Proposed mechanisms of harm that aren’t based on the appeal to nature are similar, and in some cases greater, than organic and conventional agriculture, yet GMOs are singled out for special fear. That fear is difficult to overcome, because you can’t reason someone out of a position they did not reason themselves into.

Note: This blog post is part of a series.
Part 0 is here.
Part 0.5 is here.
Part 1 is here.
Part 2 is here.
Part 3 is here.

Back in the cabin again!

I’m typing this blog post in front of a huge picture window overlooking a temperate rainforest in rural Washington state, which means I’m back at the cabin where Eve Rickert and I wrote our polyamory book More Than Two. The cabin kitty, Whiskers, has been happy to see us, and has scarcely stopped begging for treats since we got here.

This time, I’m here to write my memoir, The Game Changer, about my relationship with my partner Shelly and the many and varied ways it changed my life. Poly folks–especially those of us who are poly activists–tend to be salesmen for polyamory, which means we don’t really talk about the ways polyamory can be disruptive…even when we have years of experience and think we have a pretty good bead on how to make it work.

A lot of folks contributed to the croudfunding of this book, and yet, I’m feeling kinda stuck. For years, I’ve written about the lessons I’ve learned and the conclusions I’ve come to, without really writing about how I got there. Now, in this memoir, I’m trying to write something very different from anything I’ve done before: I’m trying to write the personal story of how I came to be who I am, and how I learned the things I’ve learned. And it’s really hard! They say you get good at what you practice. I haven’t practiced this kind of writing.

And that means, for the first time I can remember, I’m grappling with imposter syndrome. I know you all helped support this book financially, and that means you want to read it…and I don’t want to let you down. But I am struggling with how to write this book.

So, for those of you who want to read The Game Changer, I would love if you could tell me a bit about why you want to read it. I’m trying to get this thing out of my head and into the computer, and I could use your encouragement.

Whiskers and I both thank you.