In regards to the “hack” it turns out they are fairly common and what happens most of the time is re-direct codes are secretly placed in pages in the blog so the traffic to this blog or any other hacked blog is directed to their spam website.

I’ll admit I don’t know how the hack happened but my best guess is that I wasn’t updating WordPress (the publishing platform this blog uses) often enough to patch security holes.

Expect everything to be functional again within a week. Once the blog is functional it’s easy for me to write content again for it.

I discovered today my blog was hacked and wasn’t working properly.

The error string being displayed was:

syntax error, unexpected T_STRING in [directory listing] on line 18

so I googled it and came upon this wordpress support page which led me to a blog post on how to completely clean your hacked wordpress installation.

I installed a new theme but I’ll still need to work out the kinks tomorrow.

My post involving saving money on movie tickets through Fandango was included in this edition of the carnival.

My post the complete overview to dining for miles on Rewards Network was included in this edition of the carnival.

BankAndFinanceDeals.com

The name pretty much says it all. It’s a collaborative project which I will contribute to from time to time. I simply just don’t have the time post finance related deals in regular intervals on this blog so I figure instead I’ll let more interested parties take over.

The new contact form has a captcha which hopefully will cut down on the spam I use to get with past forms. The plug-in form is by Mike Challis and available here for anyone interested.

I disabled all the plug-ins and whatnot to try to solve the problem but that didn’t work. I changed the theme of the blog and that seems to have stopped the redirects. I then discovered the source of the redirects was due to some javascript code in the header.php of my old theme.

The javascript code is huge and looks something like <script language=javascript>document.write(unescape(‘%3C%73%63%72%69%70%74%… The reason for the size is that it seems to be encoded and I’ve been having trouble decoding the thing even with a decoder to determine the url from which the script was being called.

Which begs the next question of how did that string of code end up in the header.php file of my blog? It could be a number of things from server side malware to the laptop I use to edit this blog being compromised.

Update: I figured out how access was gained. Apparently someone signed up for a subscriber account on my blog and then inputted a certain string of text in the “First Name” box field that designates their account administrator privileges.

The summary of the privacy policy goes like this:

Generally I don’t collect any information from visitors besides what people optionally submit via comments on a post. You may view this site anonymous and you may even comment anonymously. Identifying information is not required to submit a comment as name and e-mail fields are optional. Any information collected such as a name or e-mail address is strictly used to contact the person that left the comment.