keithwp

While my host was of very little help, I’ve taken a couple steps to help mitigate future problems.

I’m now backing up the db much more frequently, so I can compare and get an exact date when something was changed.

I started blocking China (amongst other countries) from my website wholesale via .htaccess.

I made a minor change to wp-db.php that records each and every query to a separate file with date/time and IP address stamps. My blog is not that busy/popular, and although its generating relatively large logs, space is available and cheap. Mind you, this is just sort of outbound queries to the database NOT the results from the queries. I tested both posts and edit posts, and if WP is being used in the commission of the crime, then I’ll have an entry with some information. I’ve been grep’ing the logs for “iframe” and “wp-stats” which I think is a very good indication something funny is going on.

thanks

For what it’s worth, this happened to me as well.

Sometime between 10-31-2007 and today. AVG alerted one of my users today who reported

“AVG antivirus pops up two warnings: one for JS/Downloader Agent, and one for ‘Exploit.'”

Also iframes, hosts (www.)wp-stats-php.info and 61.132.75.71, both serving up wp-stats.php. As soon as I did a whois on the domains and saw they were China, I knew something was afoot.

I was either running wp version 2.2 OR 2.3.1, I simply can’t narrow everything down. Even if I knew when I upgraded to 2.3.1, I still don’t know when the attacker performed the SQL injection, or whatever it was.

I used phpadmin to search the database for “wp-stats” and that located the troublesome posts.

Is there any definitive answer yet as to how/why/only 2.2 was vulnerable, etc?

Thanks