Project Notes hacked

I’ve had a problem over the past few months with someone hacking these Project Notes.  The symptom is a link with text “handjob santa” added very intermittently to the title block of the pages.  It has appeared immediately after “Jim’s Projects” and after “Workshop 88”.  The link points to a non-existent or expired domain (opengadgets.net/handjob-santa).  Thankfully, the hack isn’t very harmful.

I first saw it very briefly (and then not there – triggering the usual “Did I really see that!?” reaction) this April.  I called GoDaddy support April 18 but got no insight.  The rep raised the question of whether it might be a hack to my browser rather than the site.  Two kind commenters told me they’d seen it – Brad on May 3 and Andrew on May 13.  Thanks, guys!  So I’m not crazy, and it’s not just my browser.

Ssh’d into the root of my hosting account, I tried a find . -exec grep “handjob santa” {} \; -print , hoping to discover how the hack had been embedded.  Unfortunately, GoDaddy has a robot that kills processes that run for more than a minute or so, so that command didn’t complete.  I tried several variations of that find, including just running from the wordpress directory, but still got no joy.  Of course there are lots of ways to obfuscate a text string, so that was hardly a definitive exploration.

While googling for evidence of other sites with a similar hack, I found none, but was startled to see several hits on my own pages.  Of course following the links showed the current pages – with no hacked string.  But bless Google’s digital heart, the green link with the URL just below the main line in each hit has a pulldown which includes a link to a cached copy of the page.  Sure enough, those cached copies contain the hacked in link!  Now I had several nice static instances to examine.

Looking at the page sources, the added links on both the “Jim’s Projects” and “Workshop 88” instances  were immediately before a “</div>” tag:  one at the end of the “site-title” div and the other at the end of the “site-description” div.  That might be helpful.

Armed with that, I called GoDaddy support again today (5/16/15), and Justin provided some valuable help.  He pointed out that it might be related to the WordPress “theme” I was using.  That makes sense.  If you wanted your hack link to show up well, the site title and description sound like good places to put it.

But even better, he had me check my WordPress dashboard to see if there was an update to my theme.  Such an update probably just overwrites the whole wp-content/themes/<this_theme> directory, and so might wipe out anything hidden in there.  There was an update, I installed it, and it might have fixed the problem!  Unlike my experience, Justin consistently saw the hack link on live pages of my site.  After the update, they were gone!

I made a script to get the filenames and sums of all the .php files under wordpress, and ran it to get a snapshot.  I think that will let me spot any changed .php files if it happens again.  I also tarred and gzipped a copy of the themes directory in case they do the same thing again before there’s a new themes version to conveniently overwrite the bad stuff with.

What a nuisance!