One of my regulars writes, re the recent spam-raping of the blog
>I’m still trying to figure out what the attack was. All the comments were replaced by spam?
No. What happened was that on Sunday night I caught a bot in the act of replacing real comments with spam, oldest first. It was working its way forward in time, apparently limited by the spped at which the PHP in WordPress could respond. It was very lucky that I caught it as soon as I did; I happened to need to look at a post from 2002 twice within minutes and saw the comments had changed.
I think the purpose of replacing oldest comments first was to delay or prevent me from noticing what had happened until the whole blog was corrupted. And corrupting the blog wasn’t the actual aim, anyway; what they were actually trying to do was boost the Google ratings of various shady marketing and scam sites by stuffing a fairly high-ranked blog with links to them.
Thanks. So it was an attempt to replace all the comments, or possibly all the comments from before a certain date by spam.
It seems as though it would be more intelligent to replace, say, 10% of old comments by spam, but I may be missing something.
I knew that the purpose of such a thing would be to improve Google ranking.
What was the security hole?
>What was the security hole?
Unknown. Probably an error in the PHP code, somewhere that could be used to slip SQL commands through to the back-end database. I’ve upgraded to the current release.
Probably some SEO scammer looking to improve his ratings with his customers. Then again, I’m about 95% convinced the entire SEO industry is a scam, anyway.
So WordPress version what fixes this exploit?
I had a few comments somehow appear in my blog without showing up on my own comments RSS feed. I killed them when I saw them, but now I wonder if they were changed via the same method. I have backups.
In the past I’ve resisted the knee-jerk WordPress update because they were in the habit of releasing crap with an important bug-fix|exploit-patch 3-9 days later. I guess they’re doing a bit better nowadays.
WordPress is an awfully large and tempting target for spambots.
Out of curiosity, is the term “spamrape” an accepted term of art? I ask because I would prefer something a little less squicky, if possible.
>Out of curiosity, is the term “spamrape” an accepted term of art? I ask because I would prefer something a little less squicky, if possible.
I invented it for the occasion. Nothing less seemed sufficiently squicky.
I wouldn’t be surprised if it caught on.
> Out of curiosity, is the term “spamrape” an accepted term of art? I ask because I would prefer
> something a little less squicky, if possible.
It seems an apt term to me. It is spam by forcefully taking (“raping”) control of a blog.
Now that’s got me thinking about security measures. While the obvious preference would be to not have an exploit in the first place, tripwire-like behavior as applied to the database might be an interesting avenue.
Consider a database that has regular backups (or even replication) to a separate system. Over time, one could develop a statistical model of the usual churn in various tables in the database, and have an alert generated when that’s violated. Particular triggers might be plausible, too.
I suspect that’s already done in some sectors, but I’m wondering if it could be done in a more generic way in an open-source project.
The act itself is pretty damned squicky.
How about “spream” (from sp
am+ream)?@Standard I dropped WP from my site for much the same reason; I’ve got enough different web apps facing the wrathful and malicious Internet that I’ve got to keep patched.
For one reason and another, I’m poking their managed hosting for new things. (My main site’s blog now takes the form of Reddit ‘text’ posts. A tricky format, to be sure, but it’s working well enough.)
Someone’s going to make a dildo out of SPAM(tm), and pictures of it will float around the net…
Hmmm… WordPress adds rel=”nofollow”1 to links in comments, so I don’t see how replacing comments with spam can improve SEO.
1) “nofollow” is though misnamed: it is not about following links, but about influencing link target’s ranking in the search engine’s index. Well, I guess it is about search engine not following link to include it in rank for target site…
@Jay: I’m sure there’s a Rule 34 image out there already.
@The Monster:
Um, no. That sounds to much like …. wait, this is family-friendly blog (right, Jay?). We’ll just say it sounds dirty.
@Jay Maynard and @Andrew:
Your wish is my command, sir!
What I don’t get is why it replaced already existing comments instead of simply adding new comments to the old posts. This way it could go completely unnoticed while now all of its “work” is lost. Is there some benefit for a spammer (in terms of the rank of the link stuffed) when an old comment gets replaced with the link?
Yes. Google’s PageRank algorithm takes temporal data (time information) into account. Obviously I can’t know for sure since I am not privvy to the secret details of PageRank, but this is a phenomenon that one can directly observe.
The term is perfectly named.
http://xkcd.com/810/