4
WordPress疑似被攻击
今天访问blog的时候,突然发现在加载http://itsallbreaksoft.net/tds/……这么一个页面,觉得很蹊跷,立即google之,相关文章寥寥无几,找了其中一篇英文的(By Kee Hinckley on February 3, 2010 9:24 PM):
I just had a number of friends get nailed with a WordPress exploit which redirected users from their blog to sites in China. Exploits like this have been around for ages, and the constant need to update WordPress is one reason I use MovableType, which creates static sites and is therefore much less susceptible to this sort of thing, but be that as it may. CHECK YOUR BLOG FOR UPDATES REGULARLY!
I don’t know the actual mechanism by which the code was inserted into the blog, it’s a small piece of Javascript inserted into the PHP header file for the site. The one person whose blog I looked at in detail was running 2.6.1, which has an exploit which allows people to create their own admin account, but it could have been any other number of issues. The current version of WordPress as of this writing is 2.9.1. UPDATE!
That code sends your browser on a wild goose chase through several servers, each of which is inappropriately allowing the user to create a redirect to yet another site. Some of those servers are probably compromised, because in the hour I looked at one site, the same exploit code sent me to different sites in China. I would rate the odds very high that those sites may contain malware exploits against some web browsers, so if you aren’t up-to-date with your browser patches, it’s time to run your anti-virus software and cross your fingers.

