« New CDs This Week
My Toolkit »

I’m Not 1337, I Was Hacked Today

Published August 20th, 2007 in Tech & VC

I was surprised to browse my blog today and find that the background of the site was black and there was a PHP shell script located in my sidebar. See screenshots at the bottom of the post.

Someone replaced my the contents of my WordPress sidebar.php file with a PHP shell. So, I swapped the sidebar.php file out for an old sidebar.php file I had lying around in backup, and I changed a few passwords to FTP and admin access… but I still have no idea how someone got into my blog and mucked with the contents of my php files. Anyone heard of similar problems/exploits on WordPress blogs? I’m using WordPress v2.2.

I don’t think anything really bad happened, but I’m still bummed that I got pwn’d ;)

Anyone got any advice?

Screenshot of my blog (click for larger image):
hackedblog-screenshot-middle.png

Closeup of the shell script in my sidebar:
hackedblog-screenshot.png

3 Responses to “I’m Not 1337, I Was Hacked Today”  

Feed for this Entry
  1. 1 Nate Westheimer Aug 20th, 2007 at 9:48 pm

    Everyone knows your password was “KING.”

    Anyway, that sucks. I wonder if it could have been something from one of your widgets. It’s interesting how we just grab js from all around the internet and allow folks to load junk onto our web pages. It’s a dangerous world!

  2. 2 Steve Aug 21st, 2007 at 3:45 am

    You likely weren’t hacked by such “traditional means” - it’s likely that you were running some old code (from the looks of it last updated a year ago) and a remote execution php script exploited your site. It’s nothing personal, these bots look for any potentially vulnerable site (generally via Google), and try to attack them all. To prevent this from happening in the future, just always try to keep your software updated to the most current version.

  3. 3 candice Aug 23rd, 2007 at 9:10 pm

    I’m seconding the possible sidebar thing. But your server logs probably have the best answers, they just take a while to extract. I would find a unix sysadmin junkie friend locally with a bit of free time, buy them a beer and hand them the shell account for a little while…this kind of “forensics” is fun.

    (and proof of having no time, I was going to post this comment, like, days ago.)

Leave a Reply