Archive for the 'Blog Security' Category

Are You Protected From Blog Security Issues?

Tuesday, May 13th, 2008

Recent news from Technorati should have all WordPress bloggers checking their blogs, particularly their blog content for any hidden links. If you have used WordPress versions pre 2.3.3 then your blog may have been compromised.

It seems spammers had found a way of getting into your posts and leaving small hidden links to sites - generally speaking, sites that you would not want to be connected to. This has several consequences which as bloggers, could be quite serious.

Google Penalty

As they are using hidden text, this could see you coping a penalty from search engines like Google. They consider hidden text within your blog content to be a black hat technique to get higher rankings.

Lose your Technorati index

Technorati will discontinue indexing blogs that are using WordPress pre version 2.3.3 because of the security problems and the potential for spam links.

These issues have serious consequences for anyone who blogs. If you rely on a blog to promote your business then you can ill afford the loss of resource such as Technorati.

The solution of course is very straightforward. Either upgrade your WordPress blog to version 2.3.3 or go straight to the top and do the upgrade to 2.5. The bottom line is, can you afford to have your blog compromised? Can you afford to have your Google ranking penalized? Can you afford to lose a valuable resource such as Technorati? Three strikes and your out. I think its time to upgrade.

Aggregation, Scraping: What’s The Difference?

Tuesday, February 19th, 2008

Some bloggers spend too much time worrying about scraping, a form of content theft. I prefer to call it what it is - plain and simple, it is theft.

Content scrapers typically subscribe to your RSS feeds then use automatic posting software to post your content on their blogs and websites alongside Google AdSense ads in hopes of profiting off of your content. Some of them actually make a pretty decent amount of money through this practice even though it is unethical and, technically, illegal. Because content scrapers have ways of maintaining their anonymity, it is virtually impossible to ever prove that someone stole your content and that makes suing them for damages next to impossible. Should you even worry about it?

There are two types of scrapers. Some scrapers take your articles from article directories and do not include a link back to your blog or website as is generally acceptable. In addition to attempting to profit from your content they do not even give you the credit for creating it, making them guilty of a double sin. Other content scrapers will take your content and at least link back to your website with an attribution link. They still include the AdSense ads next to the cotnent, but I find this kind of content scraper less of a threat because the search engines know that your content was on your site first and will give you the credit for that by indexing your content in their search engines. The content scraper is banking on you following the link from the back end of your blogging platform and clicking on an ad or approving their trackbacks and profiting off of your visitors clicking through to their websites from your blog.

I have a way of dealing with that second type of content scraper. I don’t approve their trackbacks. That effectively gives me an inbound link from their website (which won’t help me much if any at all because their website likely will not be crawled), but it also does not give them the reciprocal link they were hoping for and therefore cutting off the only hope of traffic that they may get. In order for them to profit from scraping my content then is to market that content themselves and they are not likely to put forth the time and energy to do that. Therefore, I kill their profits.

To me, it’s a waste of time to worry too much about content scrapers beyond that because I just end up eating away my time, which cuts down on my profits. If they make a little bit of money from my content then it’s no big deal. They are likely not getting rich from my content. They may make a few dollars each month and that’s about it. Content scrapers make their money through a numbers game by stealing thousands of web pages’ content and using AdSense to profit from the totality of their theft. I believe it’s just a matter of time before the search engines address the issue and stamp it out. I’m not all that worried about it.

What Is Content Aggregation?
On the positive side of things, content aggregators use RSS feeds from various sources to populate their web pages with content. They may or may not profit from this activity, but since it is considered legal and ethical it doesn’t matter if they do. Aggregators usually have the permission of the content owners whose feeds they aggregate. They may be niche oriented or general in nature, but content aggregators do not pose a problem for content creators. They always link back to the original source and give attribution where necessary. That is the difference between a content aggregator and a content scraper.

The content aggregator can be good for your business. It’s another way for you to market your content and attract new visitors to your website. The most popular blog aggregator online is Technorati. I am a member of a content aggregator that specializes in literary content as well. There may be content aggregators for your industry. I’d encourage you to find suitable content aggregators and join so that you can expand your reach into the online marketplace. And don’t spend too much time worrying about scrapers.

GoDaddy Needs To Catch Up With Wordpress

Friday, December 14th, 2007

If you get godaddy hosting for your blog and then go to their control panel to install wordpress for your blog, you will find they are installing an old version of wordpress.

The newest version of wordpress is 2.3.1 and can be found at wordpress.org.

Some older versions of wordpress are open to an exploit and are a security risk. You would think that a company as big as godaddy would have the latest version, but this new version has been out long enough to give godaddy a chance to update and they just haven’t done it.

If you need your blog updated to the latest version, even if you host at godaddy, we can help. For just $60 we will update your wordpress blog to the latest version.

You can email me at namecritic@blogs.pn for more information.

Google Knows Your Wordpress Passwords

Sunday, November 25th, 2007

Now that is a headline that grabs your attention. It goes to the point we make here all the time about taking the time to create a headline that grabs the readers attention.

But enough about that. You want to know about Google and your passwords right?

Forgotten your password? Google can find it for you. Unfortunately

There’s a certain amount of crowing associated with hacking the blog of a security team - which might be why a hacker, apparently Russian, broke into the blog of the Cambridge University security team at the Light Blue Touchpaper blog.

He did it via some weaknesses in their Wordpress installation, upgrading himself from a plain “can post” user to an admnistrator of the blog using a zero-day (that is, previously unnoted) vulnerability, via SQL injection.

You shouldn’t, in theory, be able to extract the original text from an MD5 hash. That would take millions, or at least thousands, of computers running all the time.

But Steven Murdoch began thinking. Who is there out there who has thousands of computers running all the time? Um, everyone. And some might be generating MD5 hashes and putting them on the web…

He took the hash - 20f1aeb7819d7858684c898d1e98c1bb - from the database and stuck it into Google. Lo and behold, it turned out to be “Anthony”.

So far, so trivial. Except this: if someone does the same trick on a site that you use, they might be able to get read access to the database. They’ll be able to see the username and email associated with the MD5 hash. And, on the assumption that you use that password repeatedly, such a hacker could trawl the web looking for places you log in.

The Rest of The Story and what to do about it here