One Regular Expression

i.?[:punct:]?.?f.?.?.?r.?.?.?a.?.?.?m.?.?.?e

That should find most iframe phrases when used in a SQL query, which I won’t lay out here (fairly easy to do with phpMyAdmin, it’s literally a copy and paste procedure in the “search” form just change the mode to the proper setting). I tested it against over a year and a half of my archives with some purposely planted and obscured iframes and it has no false positives. This will find any iframe obscured via methods found in attacks on Weblogs.us and it’s users. It may be advantageous to remember this for when Iframe-B-Gone is ready.

-John Havlik

[end of transmission, stay tuned]

Mtekk Iframe-B-Gone

Seems that the events of early last month did not stop. More and more WordPress users are having issues with malicious iframes being inserted into their blogs. Until now, there were no automated detection and removal tools. Iframe-B-Gone, it’s quick, it’s dirty, but it should do the trick. I’ll get a build up sometime this upcoming weekend, after Beta 3 of Breadcrumb NavXT.

What to expect from Iframe-B-Gone:

  • Scanning of the wp-posts and other WordPress database tables for Iframes.
  • Support for regular expressions for custom “evil” tag detection.
  • Notification of locations and option to not delete selected “results”.

Note that fixing hacked themes is beyond the scope of this plug-in, for that manual searching and removal is necessary, and those familiar with a the terminal shouldn’t have a difficult time figuring out the quick way of searching for stings in files contained within a folder.

-John Havlik

[end of transmission, stay tuned]

Sammy’s Banished

Sammy Kamkar, the one who over a year ago unleashed an exploit on MySpace that caused anyone who viewed his profile, or his friends’ profiles to automatically request to be his friend. MySpace filed a civil suit against Kamkar, who plead guilty and is now banished from the Internet for a classified amount of time. The plaintiffs claimed that they are “committed to protecting our community from any abusive misuse of the site.”

Frankly, after reviewing the code and reading the explanation of his method, the hack only worked for IE and certain versions of Safari. In reality the exploit was of both the browsers and MySpace, his code should never have executed in the browsers. News Corp. should go after Microsoft as they are equally responsible for this exploit. Regardless, it’ll be interesting to see how they will go about keeping him off the Internet.

In other news, Boston needs to get a brain. Overreacting to the ten or so PCBs with LEDs attached and a black plastic bag protecting the batteries was idiocy. If the police can’t tell the difference between a bomb and a LED sign, how are they supposed to do their job? Seriously the media needs to stop spreading misinformation and disinformation before the people revolt against them, oh wait that’s already about to happen (the Internet, YouTube, p2p, etc).

-John Havlik

[end of transmission, stay tuned]

Stupid Phishers, I’m No Idiot

Today someone claiming to be part of the Chase-Security Support Service sent me an e-mail claiming that they ‘discovered’ recent activity on my account and that I had to log-in to my Chase Online account to resolve the issue. Funny how they ‘knew’ that I ‘have’ a Chase card, which I don’t.

Hovering over the hyperlink, which they tried to discreetly insert a bit of cover code so the average moron would think it was valid, but instead of going to https://chase.com or some related URL the hyper link pointed to some adsl-numbers link and then the cover http://chase.com/… Knowing that this was definitely a scam, which Thunderbird warned of, I clicked the link. Firefox displayed the address as http://jaew.us/login.htm with additional variable passing in the address, defiantly a scam. I tried the https version, and got an access forbidden.

I have taken the liberty of contacting JPMorgan Chase, notifying them of this scammer, which wants your name, credit card number, mother’s name, social security number, and CVV2. After collecting this information, which I provided fake information such as 123 12 1234 for the social security number, and [Expletive] You Scammer as my ‘name’, I was sent to Chase’s real website, which is not entire secure as it redirects https traffic to its http server.

-John Havlik

[end of transmission, stay tuned]

1 Comment Updated:

New Breed of Spambot?

According to the maintainer of Spam Karma in his latest blog entry, a new breed of spam bot has emerged and has been released in the last few days. This new spam bot uses somewhat more intelligent behavior and can get past Spam Karma 2 sometimes. Bad Behavior, the spam protection that I use, isn’t very effective against these bots, which I can attest to since I had swarms of spams queuing up for moderation beginning last Friday.

It seems that there is an update coming to Bad Behavior which may end up stopping these new bots, but it won’t be available until Bad Behavior 2 arrives sometime this year. Michael Hampton, Bad Behavior’s maintainer has released an alpha but it will be some time before a final release will arrive. If you wish to speed the release of Bad Behavior 2 please donate to his paypal account, his laptop died on the third of January and he doesn’t have the cash to repair/replace it.

Here is the link: Michael Hampton’s Blog

Here is the link: Dr Dave: The State of Spam [Karma]

-John Havlik

[end of transmission, stay tuned]