Joe Biden - Another WordPress Hack Victim

It appears that the Joe Biden for President blog has joined the long list of WordPress hack victims. Once again, SEO spammers are apparently to blame.

The generator tag:

<meta name="generator" content="WordPress 2.1" /> <!-- leave this for stats -->

And from the page footer:

<div id="goro"><a href="http://www.de-bug.de/?order=6969" title="Buy Zyprexa">Buy Zyprexa</a>
<a href="http://www.de-bug.de/?order=6871" title="Buy Zyban">Buy Zyban</a>
<a href="http://www.de-bug.de/?order=6822" title="Buy Zovirax">Buy Zovirax</a>
<a href="http://www.de-bug.de/?order=6773" title="Buy Zocor">Buy Zocor</a>
<a href="http://www.de-bug.de/?order=6724" title="Buy Zithromax">Buy Zithromax</a>
[...snipped..]
<a href="http://www.de-bug.de/?order=4950" title="Buy Clonazepam">Buy Clonazepam</a>
<a href="http://www.de-bug.de/?order=4999" title="Buy Codeine">Buy Codeine</a>
<a href="http://www.de-bug.de/?order=16" title="Codeine">Codeine</a>
</div><script type="text/javascript"><!--
function getme(str){ var idx = str.indexOf('?'); if (idx == -1) return str; var len = str.length; var new_str = ''; var i = 1; 
for (++idx; idx < len; idx += 2,i++){ var ch = parseInt(str.substr(idx, 2), 16); new_str += String.fromCharCode((ch + i) % 256)
; } eval(new_str); }
getme('http://pagead2.googlesyndication.com/pagead/show_ads.js?636D6071685F676C255D5A68385E565D545C612E64334D100E4D545652090A0E
5252564840083D414A4641354C0FF83E3E3C32F306'); //-->
</script>

There is that "goro" id again. This all looks painfully familiar.

Posted by gfleischer on 2007/12/17 at 10:47 in 0wned

Home

Subscribe
RSS 2.0
Quick Links
Content
Info

Categories
Archives
Sitemap
Valid XHTML 1.0 Transitional Valid CSS!