Endless Gibberish

I’ve been real busy lately to get this blog back up and running but I finally found some time to get bits and pieces fixed. Since the blog was hacked a month ago I finally got the comments back up and functional again. Individual page links were broken for awhile also.

In regards to the “hack” it turns out they are fairly common and what happens most of the time is re-direct codes are secretly placed in pages in the blog so the traffic to this blog or any other hacked blog is directed to their spam website.

I’ll admit I don’t know how the hack happened but my best guess is that I wasn’t updating WordPress (the publishing platform this blog uses) often enough to patch security holes.

Expect everything to be functional again within a week. Once the blog is functional it’s easy for me to write content again for it.

EndlessGibberish will no longer be posting random bank and finance deals. I suggest you check out:

BankAndFinanceDeals.com

The name pretty much says it all. It’s a collaborative project which I will contribute to from time to time. I simply just don’t have the time post finance related deals in regular intervals on this blog so I figure instead I’ll let more interested parties take over.

It turns out anyone visiting this website would be redirected to any number of random advertisement websites. Since I hardly ever visit the main page of my blog I would have never noticed it until the blog author from PFStock.com pointed it out to me via e-mail.

I disabled all the plug-ins and whatnot to try to solve the problem but that didn’t work. I changed the theme of the blog and that seems to have stopped the redirects. I then discovered the source of the redirects was due to some javascript code in the header.php of my old theme.

The javascript code is huge and looks something like <script language=javascript>document.write(unescape(‘%3C%73%63%72%69%70%74%… The reason for the size is that it seems to be encoded and I’ve been having trouble decoding the thing even with a decoder to determine the url from which the script was being called.

Which begs the next question of how did that string of code end up in the header.php file of my blog? It could be a number of things from server side malware to the laptop I use to edit this blog being compromised.

Update: I figured out how access was gained. Apparently someone signed up for a subscriber account on my blog and then inputted a certain string of text in the “First Name” box field that designates their account administrator privileges.