Helpful Coder

A long-time client contacted me with a question about their SSL certificate, and said they thought the site "might be hacked." Well, boy was it hacked. Shell scripts everywhere, and core Wordpress files as well as plugins heavily modified. I think it's all cleaned up now, so I thought put up a quick post about the process while it's still fresh in my mind. How to know it's hacked? In this case, it was easy. The site looked fine in the browser, but when I logged in and looked at the files on the server there were quite a few shell scripts which are little php files (in this case) that give the attacked a 'back door' to continue to upload files/etc even if their WordPress access was closed off. Additionally, there were many core files (wp-config.php for example) that had huge chunks of encoded text inserted at the top of the file. Additionally, looking at the transfer logs revealed traffic to weird looking URLs that were definitely not legitimate pages/post...

Passwords are something we all have to live with. There are other authentication methods slowly coming into use (i.e. two-factor) but it's hard to see passwords going away anytime soon. I assume everyone knows the basics - use "good" passwords, don't share them between sites, don't write them on a sticky note on your desk, don't save them in a file named "passwords.txt" on your computer, etc etc. That's all well and good, but there's so much more you can do! Good Passwords A "good" password is hard to guess, is what we're told. I think most people are unclear about what exactly "guess" means. These days, it means that it needs to be resistant to password cracking attacks that are getting ever more fast and sophisticated. Just making sure that you have numbers, characters, upper/lower case, etc isn't enough. The gold standard most important thing about a password is that it is long . The longer the better....

A lot of people know what incognito mode (or private mode) is at some basic level. They should use it when they want to do something "private" on the web. But I think most people don't actually understand what it means and how/why to use it. Perhaps this will help. Before we start - cookies are little bits of data used to track you between page loads. Think of it like a fingerprint. They're extremely important for session handling, so that a site can remember who you are from one page to the next. But they're also really handy for things like advertising services to track your activity on the web. When you open a new incognito window (and don't have one open already) - you're starting a new session in your web browser that doesn't have any of the cookies or caching that your "normal" browser window has. In practical terms, this means that when you visit a site, they won't have any history of you (mostly) and you may need to relogin, ...

Combine a huge new botnet that's sending 500k pieces of spam a day with the fact that many of the captchas protecting sites like gmail and hotmail from automated spammers - and you get a spam bonanza. Yummy!

This is a system I've been working for for probably a couple years now total. It runs on a fairly busy site, and is meant to prevent comment spam. The comment system itself uses flat files, and is a custom-coded ColdFusion system, built to order. I'm not a huge fan of ColdFusion - it seems like everything I try to do with it is about twice as difficult as it should be - perhaps I'm just too used to PHP and Perl. Anyways, I'm going to give a general overview of the system. I can't post code, because the code belongs to the client. But perhaps the general idea of the system will be enough to be helpful to someone out there. So, when someone leaves a comment, it's immediately visible and an email is sent to the admin, so he knows and can take action if the comment is spam. That worked fine for far longer than you'd expect, but eventually the spammers found it and started bombarding him with crap. So, the first line of defense we added was quite simple - it bloc...

Long time no post. Been busy busy! Anyways, this seemed like it may be a helpful tip. I spend my days in office (like most of us) and often have tasks that I'd like my computer at home to be working on while I'm gone. For example, I have large backup files on my web server that I like to download down to my computer at home for safe-keeping. Or sometimes I just want to check email or do other non-work stuff that's easier (and safer) to do at home. This is where tightvnc comes in. It's a free, open-source program that sets up an encrypted connection to another computer, and allows you to see and use that computer as if you were sitting there. You install the server program on the computer you want to monitor, and then use the client program to connect to it over the internet. You'll generally have to do route some ports in your router so that you can connect to the computer, but that's pretty straightforward. This is especially nice for checking email. One thing...

Just noticed this today, although it's been like this for a while... Users of National City online banking - at least the personal banking users - might be interested to know that they've actually made their site less secure , while claiming to make it more secure... It used to be a standard login over SSL security - you entered your username and password into a form, and logged in. But now they've broken that into two steps. First you enter your username, and hit enter. Then you enter your password into a specially customized form that I guess is supposed to protect against phishing attacks, because it has a unique background and phrase on it. I guess the theory is that you'd notice if you were trying to login to a fake National City, because the personal background/phrase wouldn't be there, or would be wrong. But here's the problem - an impostor trying to brute-force an account would actually receive feedback from the site if they guessed a correct username! ...