I always thought we wrote some fairly objective and helpful stuff on this blog, but I guess not everyone feels that way. A lame SOB by the name of Malcor has been targeting Mac related sites for defacing (as Glenn found out), and while I admit that we were heavily warned it seems that we were indeed hacked yesterday. It appears that none of the data was affected, but unfortunately I was away from my desk until just recently.
Update: MacApper was not really hacked! None of the following blather about WordPress is true in any way. We love you WordPress!
Anyways I took the liberty of analyzing the hack a bit in the hopes it helps others prevent this from happening to them. Although we had updated our blog to the latest version of WordPress, near as I can tell the hack was accomplished via an XSS (cross site scripting) exploit. By executing some malicious code in the query string the hacker was able to write to our .htaccess file the following:
#this is for rotten mac fanbois - suck it down.
#RewriteRule ^divider.png$ /rotten/divider.png [L]
#RewriteRule ^rotten.jpg$ /rotten/rotten.jpg [L]
#RewriteCond %{REQUEST_URI} !^/rotten.*
#RewriteRule !rotten/index.html$ /rotten/index.html [L]
The problem is that the exploit appears to be unknown to WordPress as far as I can see (I will be reporting it to them), so other WordPress blogs may be susceptible. I wish I could offer more help. I’ll try to post more as we pour through the logs. Also if anyone is interested this is the defacing I woke up to this morning if you missed it:
Thanks to Marvin Sum and all of the other kind people attempting to notify me last night, and my apologies for the interruption to our readers.
