monkey!

August 19, 2008

How hackers mess up your blog without you knowing it

Earlier today I was updating one of my older blogs to a new version of Wordpress. With the update, came a small change in my blogs template. As I opened up the template editor I noticed something strange

Literally thousands upon thousands of links to various spam-related subjects.

But how come I didn’t see them when I visited my blog?! Very simple actually. A lot of spammers now inject all these hidden links, but they only show up, and literally cover your page when you are visting your blog from a search engine, or another specified referer. A direct non-referal visit to your blog yields no links and your page looks perfectly normal.

This happened simply because my Wordpress install was very old, which was prone to exploits. Yes, despite the awesome and easy update process of a Wordpress blog I got lazy on that one

Really the best solution to this is to just keep up to date on your Wordpress installations and periodically check your source. It’s as simple as Viewing Source and you will quickly notice any strange quirks.