2 ms·

Details of the code are here: http://sucuri.net/malware/entry/MW:MROBH:1 http://sucuri.net/malware/entry/MW:MROBH:1 I am wondering what google will do if they

by sucuri2 16y ago

Details of the code are here: http://sucuri.net/malware/entry/MW:MROBH:1 http://sucuri.net/malware/entry/MW:MROBH:1 I am wondering what google will do if they keep doing malware to hide from them. Their blacklist will become useless.

tptacek 16y ago
That code doesn't really say anything about how the blogs were compromised, or anything interesting about what the attackers did with it (yup, they added js to the page via PHP, like every other WP attack).
- sucuri2 16y ago
  I agree. I wish I knew how they were getting in. All the sites we got access so far had no logging enabled.
  - Hoff 16y ago
    I have an odd XSS Javascript attack attempt captured in my logs this morning. It's an XSS attack I've not seen before.
nuclear_eclipse 16y ago
Surreptitiously browse sites using a standard user-agent string/IP, and just see if something different shows up?