>I mean, Wordpress??

Yeah, and combine that with some of the 'evil alter-ego' text and a few other seo sites listed, I came away thinking it was linkbait.

>dns servers are open and could be spoofed

New ballgame, then. I'll sit back and wait before venturing another guess.

You know, I saw that this had happened to the v7n blog and thought, "Gosh, I hope no one links to that Pirate site," because then it will be giving the link whore exactly what they want, attention.

Of course the LinkBait jaded me thought "I wonder if this is an elaborate hoax by all the sites on the list?" See what too much LinkBait can do to a girl :).

when I saw "Hello World From FuckingPirate!" in my RSS Reader. And I thought that a few of the sites on the list (such as Matt Cutts and the Hacker site) were on there to throw off that big stink of LinkBait that is coming from that site. But I could be wrong.... ;)

Added: I guess the bigger problem then is that LinkBait seems to desensitize the reader after a while, to the point where everything seems like LinkBait including a legitimate hacking...

Yep - plenty of authority sites in the mix. Link any good link list should have.

Genuinely hoping this isn't an attempt at linkbait.

You guys see that list right? Isn't there a way wordpress can track his IP and he can get sued?

Thank you

Added: I guess the bigger problem then is that LinkBait seems to desensitize the reader after a while, to the point where everything seems like LinkBait including a legitimate hacking...

I am proud if I have even made a small contribution to this phenomenon.

"You're ruining it for the rest of us!!!!!!!!"

No offense taken Shoemoney.

how many times have you seen someone stage anything

Countless. On the criminal level... never and hopefully this isn't the first time. Though "How I broke the law for links, Confessions of a LinkWhore" or "Beg, Borrow, Steal and Hack your way to Links" have a nice LinkBaity ring to them.

BTW: Andy you and NickW set the high watermark for linkbait aka: you ruined it for everyone else :)

Just posted on FP -

You guys link fast…

Anyways, I just started the first hacking cruzade… The easy targets (Wordpress blogs with register_globals=on) using a custom PHP script based on this code

The easy ones where blog.v7n.com, www.boogybonbon.com, www.stuntdubl.com & www.wolf-howl.com.

then Todd (his trackbacks now go to fuckingpirate.wordpress.com), then GrayWolf. At first I thought they might be pulling a prank on their own sites, but now I don't think so.

I'm not on the target list, but being mentioned in the intro was enough for me to batten down the hatches (so to speak).

Wordpress 2.0.7 now released:
http://wordpress.org/download/

his blog. He can run, but can he hide?

added: copyblogger beat me to it.

Small screen cap of the hackers site can be found:

http://www.jason-roe.com/blog/stuntdubl-marketing-consulting-hacked-seos-a-target/

Shoe I also found that IP in my logs .. my guess is he came to check the trackback link that my blog sent him. No sign of the exploit being run.

... removed comment ...

seems like he has re-located to http://fuckingpirate.blogspot.com/

He has only hit sites where the exploit wqs big enough to drive a truck thru.

It smells of attention getting, linkbaiting whatever you want to call it. But interesting none the less. It most likely is someone on the list but there are notables not on it as well. So it could be someone very close to one of those self proclaiming seo king personas.

Ironically enough - I was sitting in "Mustang Sally's" in NYC with Michael - when after a nice lunch chat before our im-ny.org meeting, I had several mails on my phone that had the subject of "hacked?" (while reading my pda - I thought to myself "this can't be good", chuckled, and proceeded to mustang harry's") - thank you to all the folks who bothered to mail me. No thanks to the folks who thought it was linkbait (are we really that fickle that you think I'd lie to people for links to my BLOG?), and to the schmuck who decided to publicly display my security flaw (as usual the cobbler's kids has no shoes).

Should hopefully have a report by morning, and and a restored site - currently on the train back to albany after a wonderfully pleasant evening with a great group of new yorkers, and nearby fellow sem folks.

People, it has been a long day and I have worked a lot... I will stop
defacing for a couple of days and I'll work in something for Digg.com

http://fuckingpirate.blogspot.com/

*grumble grumble*

Shoe: The pirate himself said he basically wrote a php script based off of that python code. I looked at the code, wouldn't be too hard to port over to php.

Looks like he got booted from Blogspot too :)

Other people have highlighted the large amount of redundancy in SEO commentary but have done so in a far more civilised fashion.

Me? I'm more worried about the threat to the security of my websites posed by people like this dude than I am about a few SEOs padding out their blogs with fluff pieces.

Mikkel his blogspot account is still active.

jetboy it's more than a register_globals thing. The flaw is in the PHP core, having to do with an assumption about data types. It has been fixed in the current versions of 4 and 5.

The flaw creates a problem for some PHP routines, including unset(). The register_globals issues was "solved" by some software coders (including phpBB and Wordpress teams), by using unset() to clear variables that might be untrustworthy due to register_globals being left on. That way the app wouldn't care if register_globals was on or not. BUT... the flaw is potentially a problem for all PHP code, not just web masters who have register_globals on.

Wordpress and phpBB are early targets for which working exploits were published within a week or so of the revelation by the hardened PHP team that this flaw existed and could be exploited. The flaw in PHP left opportunities, and the coding within the apps created exploit possibilities. Each app potentially creates a different, unique opportunity for an exploit to work. You don't need to have register_globals on to be vulnerable. You just need to have PHP < 4.whatever or PHP 5 < 5.whatever.

Graywolf and Todd didn't have to have insecure setups to be hacked like this. They could have been hacked because they were using an older (but not old) version of PHP, and they were using Wordpress < 2.0.7. Like most everybody else.

What can really bake your noodle is thinking about your vulnerability as a user of the Wordpress platform. If a flaw is discovered, you are vulnerable and can't do a thing about it, as hackers target one of the largest communities in web world (Wordpress sites). BUT... wordpress dev Mark Jaquith posted an update within hours of first notice, and a full upgrade was released shortly after even though the Wordpress dev team is pushing out a new version with a deadline of the 22nd.

If you were on a custom platform, how long before you knew how the PHP flaw was a factor based on how your app was coded, and then how long before your coders could fix the problem and provide a patch? I bet you count that in weeks at best. So how do you manage the risk...exposure via platform footprint vs. time to detect and fix? If you were a target (as these guys were) then exposure was a given, and time to fix was the key. Better to be using Wordpress.

So if you use Wordpress, go to Manage/Backup and email yourself a backup. Then go donate to the Wordpress cause, or buy something on Mark Jaquith's amazon wish list. That's just my opinion, but I think it's better than rationalizing why you were and are not at risk.

Have to give kudos to Mark Jaquith, though -- for a quick fix that didn't require zillions of WordPress users to ask their web hosts what version of PHP was on their servers, and then possibly demanding that it be upgraded.

For Michael and Todd:
http://www.ibrian.co.uk/17-01-2007/a-public-apology-for-michael-gray-and-todd-malicoat/

depends on the goals of the hacker.

On the other hand, tech support for my servers is guaranteed available - it's sitting in my seat right now.

I just checked and found the same thing as Keith, looks like it is gone.... hopefully for good. And I agree, they should be banned.

Please stop feeding the Moron.

Update your security.

Remove his links and his site name from your blogs and forget about him...

Added>>>>
Hey WilliamC are you promoting this guy? Why put up the site name? It would have been just as good to say his site was back up at another URL, and you would not have been promoting this feeble minded moron.