This blog got wormed

This blog is one of many that got hit late last week by a particularly nasty and invasive worm targeting WordPress sites. (No, it wasn’t a botched upgrade, as I saw at least one commenter speculate.) The first symptoms showed up either late Thursday or early Friday of last week, when links from the main page became garbled. What was going on was an attempt to insert pharmaceutical-spam malware into the site permalinks.

This injection attack actually corrupted the mysql database behind the blog, and some fairly serious surgery (which the ibiblio site admins were reluctant to try on a Friday) was required to fix it. All posts and coments from Thursday evening or previous should now be restored. The blog is now running WordPress 2.8.4, the very latest version which was rush-released to foil the worm.

A big hand to Ken Chestnutt, the ibiblio site administrator who did the actual repair. Regular posting will resume shortly.

56 comments

  1. So what you’re saying is that your blog has now been de-wormed. But seriously …

    By default, WordPress themes have a feature that cuts both ways: most themes add a meta tag to the header of the page, that identifies the version of WordPress used by that blog. I use this feature with a script to identify which of the blogs I manage need to be upgraded when a new version of WordPress is released, but worms and crackers can use this to determine which exploit to use to target a blog.

    I will also note that WordPress 2.8.4 has been out for over a month…

  2. I read about this problem with WordPress.

    One of the reasons I moved away from WordPress is because of these exploits which keep getting discovered at fairly regular intervals. Also I was very unhappy with the increasing bloat since the 1.5.x series. I then moved to b2evolution and was happy with that for a while until I decided to cook up my own solution. Also I no longer use MySQL but SQLite instead and my blog isn’t heavy on features and focusses strictly on exactly what I need.

  3. And you got wormed by script kiddies… You should code everything yourself these days. To be honest, I have no trust left to those forum/blog scripts out there…

  4. >You should code everything yourself these days.

    Too little time for that, alas. Leading one project, senior dev on another, and trying to have a life as well…

    I don’t believe these were script kiddies, by the way. The worm has all the earmarks of a crack written by professionals for a criminal syndicate. If I had to guess, I’d give odds it was written in Bulgaria.

  5. > I’d give odds it was written in Bulgaria.

    What exactly made you guess it was written in Bulgaria?

    1. There’s a high concentration of skilled crackers in Bulgaria, paid and equipped by Russian Mafia types. I’ve personally traced one phishing attack – which the victim blamed on me for completely idiotic reasons – to a gray ISP in Sofia. (And I’m not even a security specialist.)

  6. I wouldn’t blame the Russian mob, although it could have been their doing. The Russian goverment pays malware writers six figures to write malware and they are protected. My philosophy is to patch as soon as possible, especially for known worms in the wild.

  7. SQL is in general unsuited for web applications. The fact that there is a parsed general language makes it extremely hard to stop injection attacks.
    If you need to have an SQL database as the storage, you should force all unsafe traffic to go through an object-relational layer. If you can control what SQL
    statements get generated, you are reasonably safe.

  8. A big hand to Ken indeed. We hear a lot about bastard sysadmins, and too few words of appreciation for the ones who put in extra hours to clean up the mess and make sure that things keep running smoothly.

  9. The fact that there is a parsed general language makes it extremely hard to stop injection attacks.

    No it doesn’t. Apply a simple transform to any string coming out of the application language to escape quotes, and quote it. I even wrote a Scheme library that lets you write queries as Scheme expressions, with implicit quasiquoting so anything unquoted gets everything escaped.

    Under certain environments, such as PHP with its over 9000 ways to quote a damn character string, yes, I can see where keeping your shit straight would be hard.

    (Can you tell I don’t like PHP much?)

  10. The biggest problem must be the requirement of sending queries as a single string. I think the best solution would be implementing a special way that allows you to send encoded data, which will be stored as decoded data. Since the every character in the user input will be converted into non-escaping characters (Probably “a-z A-Z 0-9”), there will be absolutely no way for injections.

  11. Maybe I’m getting the wrong idea here, but I’m surprised that an attack was even permitted to drop tables/databases/whatever. Personally, I’d only allow a script such as this the ability to run SELECT and INSERT queries (and possibly UPDATE if you really needed it often enough…).

  12. > Personally, I’d only allow a script such as this the ability to run SELECT and INSERT queries

    It looks like we will come to that. Scripts should inform users about the exact privileges required and stop working if you give more than required privileges on the SQL server. (Just like how they act when you don’t remove the installation directory or chmod everything to 777…)

  13. “Under certain environments, such as PHP with its over 9000 ways to quote a damn character string, yes, I can see where keeping your shit straight would be hard.”

    What’s so hard in using only prepared statements?

  14. “I wouldn’t blame the Russian mob, although it could have been their doing. The Russian goverment pays malware writers six figures to write malware and they are protected.”

    And the difference between the Mob and the Government is?

  15. Under certain environments, such as PHP with its over 9000 ways to quote a damn character string, yes, I can see where keeping your shit straight would be hard.

    I have two words, which, coincidentally enough is exactly the number of ways to quote a damn character string in Python: mod_python rocks. Even better is Django, which pulls in the combined experience of its senior developers in writing portal sites for newspapers and combines that with an environment that writes all your SQL queries for you on the fly, but with built-in checks to ensure that those SQL queries aren’t subject to injection attacks. And if you don’t trust the Django developers’ code, you can always subclass the SQL generators and add your own checks.

  16. Morgan,

    I earned my bread doing Python webdev for a year or so and I can say, aside from a brief stint building a site in Scheme, Python is the language/environment I least minded doing that sort of work in. And that was with an unusual written-in-house runtime and ancient embedded Python 2.1 interpreter. (Django and CherryPy didn’t exist when it was written.)

    Jimt T,

    That hasn’t much bearing on economic theory. Economic theorists always overlook minor points like the fallibility of buyers and the wanton lack of scruples of sellers. They shrug their shoulders and say “Oh, it’ll all come out in the wash”. The consequences of this cavalierness are currently putting hardworking men and women out on the street without homes or jobs at rates not seen since the Great Depression, an externality that the economist class has been slow to internalize.

    1. >Economic theorists always overlook minor points like the fallibility of buyers and the wanton lack of scruples of sellers.

      This is only true in parodies of economics written by the (willfully) ignorant.

  17. This is only true in parodies of economics written by the (willfully) ignorant.

    Hmph. What Jeff Read says about the fallibility of buyers and the wanton lack of scruples of sellers is more or less true: Most economists, especially anarcho-capitalists, do tend to say “it’ll all come out in the wash.” Which, in reality, is more or less correct over the long haul. Over shorter periods of time, though, these externalities like the current homeless and jobless rates, caused by people who more or less deliberately caused this recession through fraudulent means, are significant. Over longer periods of time, though, in the end it won’t matter.

  18. This is only true in parodies of economics written by the (willfully) ignorant.

    So Paul Krugman is “willfully ignorant” of the discipline he just won the Nobel in?

    Rather, I think free-market economics has grown a hard core of fundamentalist followers, who enshrine their beliefs as dogma. Not surprising, as free-market economics is directly descendant from Calvinist ideas about work, virtue, and material well-being.

  19. I agree with Morgan on Python/Django. I use it for all web development and it rocks.

    As for “the Russian goverment pays malware writers…”, it is utter russophobic FUD. The Russian organized crime does exist, but it’s not related to the Russian government in any way.

  20. Over longer periods of time, though, in the end it won’t matter.

    “in the end?” nothing ends, morgan. nothing ever ends.

  21. The Russian organized crime does exist, but it’s not related to the Russian government in any way.

    s/Russian/American.

    If you still don’t see my point, all I can say is that you are very naive.

  22. Perhaps this is the right time to ask you to install some WP plugins.

    Problem: your blog isn’t quite just a blog. A blog means originally, well, a log, a site consisting of personal news in a reverse order of date, and the implicit assumption behind the whole technology is that how old a given post is has a strong negative correlation with how interesting a post is. This assumption is wrong for your blog: “The Rage of Augustine” is, for example, one of your most interesting posts ever, regardless that it’s 4 years old. Problem 1: new readers are unlikely to find it. Problem 2: new or old readers are unlikely to comment on it because it’s unlikely that others will read their comments.

    Suggestion: finding ways to make it less like a blog, less “dynamic”, less dependent on the date of posting and more like a static collection of articles where the date of posting doesn’t count much.

    Solution:

    1) A good “site TOC” plugin (as opposed to the many post TOC plugins which are useless for this purpose), for example,

    http://wordpress.org/extend/plugins/site-table-of-contents/

    and linking to it at some prominent, visible place.

    2) A “recent comments” sidebox, configured as liberally as possible, 30-50 recent comments, such as:
    http://wordpress.org/extend/plugins/get-recent-comments/

  23. “As for “the Russian goverment pays malware writers…”, it is utter russophobic FUD. ”

    The well-known connection between Russian organized crime and the former KGB (and former Afghanistan veterans) on one hand, and the well-known connection between Putin and the former KGB suggests me to assume connections between Putin and organized crime. See, I’m Hungarian, and similar connections exist here too. And similar connections exist in Bulgaria. I find it entirely reasonable that similar connections must exist in the country that had the most efficient, most powerful intelligence agency of the Eastern Block too, the KGB.

    I’ll only begin not to assume the worst of the Russian government when someone will get elected who is either a well-known Anti-Communist Conservative, a member of the former Anti-Communist Orthodox Christian resistance movement, if such a thing existed (I hope it did), or a well-known young Liberal who was schooled in Oxford or suchlike and has no ties to the former power elite.

    This is the general experience in other former Eastern Block countries: only these two kinds of people are reliable.

  24. “So Paul Krugman is “willfully ignorant” of the discipline he just won the Nobel in?”

    Yes, he is too smart to be ignorant about such stuff: he is rather consciously dishonest. There is evidence he recommended creating a housing bubble in 2002: http://rebelyid.blogspot.com/2009/07/did-krugman-recommend-housing-bubble-in.html – there are many links in this article.

    “Rather, I think free-market economics has grown a hard core of fundamentalist followers, who enshrine their beliefs as dogma.”

    This is actually true, but not necessarily in the sense you mean it. On the average, Libertarians tend to equate the criticism of certain big business in practice with the criticism of the free market in theory. This is a mistake. Pro-freemarket shouldn’t necessarily mean pro-most-modern-large-corporations-as-we-know-them. This is the main reason I’m migrating towards the Chesterton-Belloc kind of Distributism, which is basically Libertarianism taken really seriously: creating a market of many small business with near-zero lobby power each, near-zero political power each, because only that can mean a truly free market.

    “Not surprising, as free-market economics is directly descendant from Calvinist ideas about work, virtue, and material well-being.”

    This is exactly where I have to disagree. There is much to be said against NOT the idea of Capitalism in theory, but against Capitalism as is implemented nowadays in practice, i.e. aganist the political power of corporations. But this doesn’t mean liberal-progressive-egalitarian ideas are right. Virtue is important, working ethics are important, generally, political institutions should be based on ideas to promote human quality, excellence, virtue, plain simply because the basis of a good society is good “raw material” i.e. high-quality people. The very problem with politically powered corporationism is that it often rewards vices, instead of rewarding only virtues which a genuine family-business, small-business Distributist free market would do. And in this it deserves criticism: that it doesn’t manage to live up to the human ideals of virtue. But of course, this doesn’t mean that there is no such thing as virtue and all we should aim for is equal pleasure! That would mean a life equally psychologically miserable life for all.

  25. “the well-known connection between Putin and the former KGB suggests me to assume connections between Putin and organized crime.”

    The former KGB and the organized crime are distinct, often opposing forces.

  26. “the former Anti-Communist Orthodox Christian resistance movement, if such a thing existed (I hope it did)”

    The Russian Orthodox church always supported the status quo, the current government. Ironically, the organized crime was the only force the communists and the KGB couldn’t destroy, they only made it more resilient and violent.

  27. Krugman isn’t willfully ignorant, he’s a sleazy political commentator doing his best (worst?) to boost the power of the State and especially the Democratic party. Anybody who expects competent economics from his articles has his head up his .

  28. Hm, I wa s going to observe that Krugman has morphed himself from an economist to a repellent political hack, but two commenters beat me to it. I’ll only add that I think it’s a damn shame – he was a pretty good economist once.

  29. > The former KGB and the organized crime are distinct, often opposing forces.

    Really?!? What about rogue territories such as Transnistria, where the 14th Army’s vast repository is literally for sale at the local markets? What about the so-called “Moldavian” Communist president (whose family is involved in all kinds of shady economical practices) who was an active KGB officer back in the days?

  30. I am not very educated in economics myself and I have no knowledge of the man beyond the stuff he writes in newspapers, but I get the feeling (reading Paul Krugman’s column in my local paper) that he is mainly a socialist. Naturally he would be opposed to free market economics. His vision naturally will be coloured by the socialist view and in favour of greater governmental control. Isn’t that right?

    I don’t see it as intentionally dishonest. Just ideologically coloured?

  31. @strongpoint. “In the end”. It’s a figure of speech. Perhaps “in the long run,” or “in the grand scheme of things,” or maybe just “overall” would be better.

  32. Pro-freemarket shouldn’t necessarily mean pro-most-modern-large-corporations-as-we-know-them.

    That’s a smart thing to say. You’re right. Corporations as we know them aren’t interested in the free market. They pay lip service to it, of course, but (oops better not say “in the end”… :-P) overall, they’re more interested in a command and control market whereby they are in control. Walmart and Microsoft are my too prime examples, although Microsoft has been taking some interesting turns lately.

  33. Eric, this dropped today on /.: a story of an algae-fuel-powered Prius set to cross the U.S. on 25 gallons of fuel. If it’s as efficient as they’re claiming to be, and it catches on, then the energy revolution you predicted may well come to pass. I have my hopes, but also my doubts. This nation’s travel infrastructre is engineered to maximize profits to the auto and fuel makers (google “streetcar conspiracy”); until we fix that we will be consuming way mure fuel than we need to.

    @strongpoint. “In the end”. It’s a figure of speech. Perhaps “in the long run,” or “in the grand scheme of things,” or maybe just “overall” would be better.

    Morgan, you lose this round of “spot the reference”. :)

  34. Jeff, even railroad fans don’t believe the “streetcar conspiracy” had any effect on the death rate of streetcars. It’s much more likely that GM, Goodyear, Standard Oil, etc, used National City LInes to OVERPAY for worthless streetcar companies so that their successor bus companies would have the funding to buy GM, Goodyear, and Standard Oil products. Yes, it was a conspiracy, which is why they were found guilty, but since it actually HELPED the public, they were only fined $1 for it.

    The “streetcar conspiracy” is leftist clap-trap.

  35. Jeff, I notice that you cited Krugman. He has given up any claim to being an economist. I’ve heard that there’s a movement afoot among MIT students demanding that MIT retract Krugman’s PhD.

  36. Jeff: Meh. Chomsky has some f—ed up politics, but those us of with an interest in the theory of parser design are indebted to him. His tenure is deserved.

  37. @Jeff: *googles ‘in the end nothing ever ends’* Due to lack of both time and fundage, I have yet to to see “The Watchmen. :(

  38. “Does anyone deserve tenure?”

    Flames of hellfire, meet Tom’s underpants ;)

    Privately, an academic institution is at liberty to craft whatever horses-ass contractual obligations it wishes. A public institution, however, should not be able to create super-constitutionally privileged individuals. The 1st Amendment provides all the ‘academic freedom’ coverage they or anyone else is entitled to.

  39. I have two words, which, coincidentally enough is exactly the number of ways to quote a damn character string in Python:

    Actually, come to think of it, there are at least sixteen: ‘string’, “string”, ”’string”’, and “””string””” with none, one, or both of the r and u prefixes. But these options are at least somewhat orthogonal.

  40. Well, I agree with this part:

    Privately, an academic institution is at liberty to craft whatever horses-ass contractual obligations it wishes. A public institution, however, should not be able to create super-constitutionally privileged individuals. The 1st Amendment provides all the ‘academic freedom’ coverage they or anyone else is entitled to.

    Perhaps my friend Jim, who was recently granted tenure, might agree with this part:

    Flames of hellfire, meet Tom’s underpants ;)

    He would surely laugh loud and well.

    Yours,
    Tom

  41. Due to lack of both time and fundage, I have yet to to see “The Watchmen.” :(

    yeesh — read, don’t watch. there are at least three critical moments at which the moviemakers (who were reportedly quite dedicated to the original) display a remarkable insensitivity regarding what was important in the book and why. one of them involves the delivery of the line in question.

    it wasn’t entirely a gratuitous geek reference, though — one of the meanings of the original line is that no solution is ever permanent. with fallible, selfish, capricious humans involved, won’t there always be some externality lying in wait to throw off predictions and models?

  42. Actually, come to think of it, there are at least sixteen: ’string’, “string”, ”’string”’, and “””string””” with none, one, or both of the r and u prefixes. But these options are at least somewhat orthogonal.

    Funny, the same correction also applies to these two words, not only “mod_python rocks”, but, actually, “mod_wsgi rocks” too (even better), and pure-Python web servers like Tornado and Twised.Web also rock, and Nginx WSGI… and so on.

  43. Oh, I don’t think Chomsky’s politics are f—ed up. They stem from a philosophical tradition of freedom that predates capitalism and was shared by Smith and Jefferson. A philosophical tradition that will ultimately be vindicated.

    [Adam Smith] did give an argument for markets, but the argument was that under conditions of perfect liberty, markets will lead to perfect equality. That’s the argument for them, because he thought that equality of condition (not just opportunity) is what you should be aiming at. It goes on and on…

    And what are we learning today, kiddos, thanks to Mr. Wilkinson and Ms. Pickett? It’s equality of condition, and not just of opportunity, that leads to a healthier society. And what do markets do in conditions of imperfect liberty (i.e., all real world conditions)? Invariably, they degenerate into what that blog Shenpen linked to called “crony capitalism”.

    Much of the world is converging towards an era where politics not in line with Chomsky’s will be considered untenably barbaric. It’s taking longer in the U.S. than it should, as we are now witnessing with the FUD the Republicans are dishing out in response to Obama’s health care plans.

    1. >Oh, I don’t think Chomsky’s politics are f—ed up. They stem from a philosophical tradition of freedom that predates capitalism and was shared by Smith and Jefferson.

      Neither Smith nor Jefferson suffered from an obsessive need to give intellectual fellatio to any totalitarian who developed a sufficiently throbbing hate-on for America. This effectively distinguishes them from Noam Chomsky.

  44. “Much of the world is converging towards an era where politics not in line with Chomsky’s will be considered untenably barbaric”

    It’s difficult to describe the leaden horror this fills my heart with.

    I hope the US remains the one place not stupid enough to follow the herd off that cliff. With Obama’s election, however, my hope is sorely tested.

    Maybe one day we’ll dispense with the barbarism of ‘government’ in its entirety…

  45. “Much of the world is converging towards an era where politics not in line with Chomsky’s will be considered untenably barbaric.”

    Over here, the tide is already turning back, albeit very slowly, therefore I doubt that prediction.

    Cases in point:

    – market-oriented reforms in the Dutch healthcare system: http://healthcare-economist.com/2007/09/07/wsj-on-the-dutch-health-care-system/

    – First set of market-oriented reforms in Sweden 1991-1994: http://en.wikipedia.org/wiki/Moderate_Party#Recent_decades , second http://www.globalinsight.com/SDA/SDADetail7871.htm

    – It’s too earyl to say anything for sure, but surely it is interesting that in Germany, Economics Minister zu Gutenberg became the most popular politician in mere five months, given that his main cause is challenging the “culture of jealousy” http://www.irishtimes.com/newspaper/world/2009/0710/1224250386728.html

    So, I think it would be a safer prediction that the world on the whole is undergoing a “regression to the mean”, and converging towards something halfway between ESR and Jeff.

    Which could be a good thing because if there are many intelligent arguments on both sides, then it might be a wise decision to be cautious and go for the middle. The problem with that is, of course, that I can’t imagine how can that be a stable equilibrium for long.

  46. Jeff,

    I found a good example from 1994 when Krugman was a real economist. Compare it with today’s Krugman:

    http://web.mit.edu/krugman/www/myth.html

    “First, most of the speculation about the superiority of the communist system including the popular view that Western economics could painlessly accelerate their own growth by borrowing some aspects of that system–was off base. Rapid Soviet economic growth was based entirely on one attribute: the willingness to save, to sacrifice current consumption for the sake of future production. The communist example offered no hint of a free lunch.”

Leave a comment

Your email address will not be published. Required fields are marked *