9 Responses

1. Nothing To Say » Blog Archive » links for 2007-11-15

   November 14th, 2007 at 7:27 pm

   1

   [...] WordPress Hacking Increasing? Better get on that. [...]

2. Anna Vester

   November 14th, 2007 at 8:43 pm

   2

   Yep, I have noticed that about Vandelay as well. There is something weird going on. Bittbox is also having problems as of several day ago.

   “The hack seems to be adding spammy links to my RSS feeds and (every once in a while) you might see a blank white screen with the phrase “Already hacked by Magic SEO Toolz.””

   Here is link to a possible fix that was posted on the Devlounge website -
   http://www.devlounge.net/articles/protect-your-wordpress-wp-config-so-you-dont-get-hacked

   Hope this helps.

3. Alex Leonard

   November 15th, 2007 at 5:04 am

   3

   Regarding the correct setting of file permissions, I’ve often wondered exactly what the dangers are and what files shouldn’t ever have their permissions altered.

   Various aspects of Word Press or Plugins require certain folders to have their file permissions changed to be writable (666?), but I never feel certain as to how risky this is?

   Any suggestions?

4. わーどぷれすっ！ » WordPress のハッキング被害が増えている？

   November 15th, 2007 at 8:21 am

   4

   [...] WordPress Hacking Increasing? より、ブログがハックされたとの報告が最近増えてきているとのこと。個人データへのアクセスではなく、投稿内にスパムコードが追加されるようだ。 [...]

5. Michael

   November 16th, 2007 at 11:51 am

   5

   @Alex Leonard: Having file permissions set at 666 or 777 means that, in theory, the world can write to the files with those permissions.

   I learned this the hard way, when hackers uploaded various scripts for the purpose of sending spam emails. My web host suspended my account after they got away with a few hundred emails or so.

   Unless absolutely necessary, NEVER leave file permissions at 666 or 777. The normal permission set, depending on the type of file, should be 644 (for static files, like HTML pages and images) or 755 (for things like Perl scripts).

   These tips don’t just apply to WordPress. Keep them in mind when maintaining any Web application.

6. Alex Leonard

   November 20th, 2007 at 4:23 am

   6

   Thanks for that info Michael.

   So does this mean that risks are there with WordPress needing, for example, the uploads folder to be set at 666.

   Presumably there is no way around this.

7. William Teach

   November 25th, 2007 at 6:32 pm

   7

   My own site and a few others I know got hacked, having the htaccess file changed to have a 301 redirect, and some weird stuff after the body tag. The htacess was easy to fix, but, for the rest, actually had to upgrade to 2.3.1 to fix the issue. Not sure if got in through the admin panel or what.

8. free download

   December 2nd, 2007 at 2:06 am

   8

   Thank you.
   i setup wordpress 2 day later hacking :S

9. Episode 33: WordPress 2.3.2 released, WordPress 2.4 missed and changes to the podcast | PHP Podcasts

   February 12th, 2008 at 3:37 pm

   9

   [...] security gains attention: David Airey hacked using a GMail exploit, Blogging Pro wonders how secure WordPress is, Simple Thoughts details ways to harden your WordPress blog from attack, Ryan Boren discusses ways [...]