test please delete

[NickFitz]

I visit ripe.net and enter the miscreant's IP address as shown in the logs...

organisation:    ORG-[redacted]-RIPE
org-name:        businesscom2
org-type:        OTHER
address:         Yerevan
address:         Armenia
e-mail:          [redacted]@bcsatellite.net

It appears to belong to a cable and satellite company in Armenia

[NickFitz]

An examination of my WordPress installation shows nothing untoward, and the database appears to contain no other nasties.

Also, no other edits or posts have been made to the site that aren't from an IP address I use.

I conclude, after once again checking with the debugging proxy, that I have eradicated the problem.

But...

how did they get in?

[DS23]

i hate it when you get snow in your boots

[NickFitz]

Off to wordpress.org and check the documentation.

Sure enough, my cookie is all that is needed to log in as me.

And how would somebody else get my cookie?

[NickFitz]

Repeat after me: XSS

Or, to give it its full title, a cross-site scripting vulnerability.

[NickFitz]

Morning DS

[NickFitz]

At some point, I had visited a site which contained a XSS thingy which was able to steal a copy of my WordPress cookie and send it to the evil Armenian. He then modified one of my posts to embed hidden nastiness in my site (and, as it happened, in one of the most popular articles on my site).

[DS23]

Morning DS

morning nickfitz. and your website is?

[DS23]

right. time for some breakfast. marmite on toast and another cup of coffee.

[NickFitz]

Now I'm sure you're all saying "Right, porn" at this stage... but recent research by Google showed that much of this stuff is on normal sites too.

Take that site that you found in a search that had some seven-years-out-of-date, never-updated information.

Once upon a time, that page had a counter at the bottom - one of those things you used to see that said

You are visitor
0000NaN
Counter supplied by cute-web-counter.net