Another Guy

My thought was only when the slider is disabled (not used) that it might be good NOT to include the script into the header. It makes the theme just that little bit faster.

Jan, your side note is correct, but…

Understand that if there is a file that is (a) commonly installed on EVERY wordpress install, and (b) rarely actually used by the sites in question then it’s a perfect file to overwrite when attempting to hack a system. If you get a plug in that allows writing to files outside of the upload directory, hello.php is a perfect place to land your hack – and most people will never check it until it’s too late. It’s in an executable directory, it’s a file that’s always there, and it’s a file that essentially nobody uses.

Basically, most people would scan your wordpress install and never run across hello.php – so they don’t generally check it for a hack. The result is many hacks are written there.

Almost everything else in wordpress has a use and is commonly used. This piece of legacy code is unused and not required for a normal install.

Askimet is more of a question of a commercial service that not everyone chooses to use. It’s a plug-in, nothing more. No other commercial plug in gets such preferential and repeated distribution, and it adds extra code to every download, and extra steps to remove it from every install that doesn’t use it. It also means that automatic updating is NOT an option, as this unwanted payload will be “updated” back onto the wordpress install each time.

Cloudflare does not detect it at all, they seem to be focused only on wp-login.php and xmlrpc style things. This is a pure DDoS attack nothing more and nothing less. I log:

ip / cloudflare ip url requested

to a text file, and logged 120MEG of entries in 8 hours – all trying wp-admin and nothing else.

They hit wp-admin, never follow the 302, never actually ask for wp-login.

My guess is that on a weaker server, this sort of thing would be an effective DDoS, on a site with unmodified wp-admin, they would be creating an insanely high load on the system, as each call to that page fires up database connections and checks to see if the user is logged in and such. it’s not heavy duty, but I am pretty sure it would be enough to TANGO DOWN a virtual. it’s also pretty clear (considering they move from one service to another as soon as I block one) that they have a lot of resources to play with. I think if they really tried, they could even take a much larger server down (if it wasn’t protected).

Jan, I still think you miss the point. People knocking on a door suggests that they think the door may actually open. It is incredibly silly to knock on a door that generates a clear and obvious error message, as your door knocking stands out rather obviously. It’s an error that is written to the apache error.log file on the default settings of a standard LAMP install.

Everything you say is correct, except totally lacking on context. Yes, directly accessing the file generates the error. We know that already. The question is why is it being accessed? Is it a hacking attempt, or is it a bug in wordpress or certain themes that tries to access this file when users are not logged in?

The functionality of wordpress under normal circumstances is clear, and we all understand it (I looked at the code before I even bothered to post). Door knocking this particular file seems a bit off, and having found a cached hack on someone else’s site makes me wonder.

This piece of oddness got my attention, it’s the standard “c99” rootkit being used to specifically attack admin-bar:

[ Moderator note: Link to cached exploit code deleted. If your site is hacked please follow this advice as above. ]

“I don’t see any issue”

In simple terms, if someone is knocking on a particular file on more than one installation, then you have to ask why. You make the assumption of an already hacked wordpress install, my feeling is this is much more an attempt to create a hole, not to profit from it.

I tend to go with Kyle T on this one, it looks like someone has figured out a potential hole, or that a different hack modifies this file to allow for a back door to create a recurring hack. It looks potentially like someone checking to see if an installation has been hacked or modified.

It’s also the first file in that directory, alphabetically.