Comments on: Mass infection of WordPress blogs at Network Solutions http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html Protect Your Interwebs Tue, 07 Feb 2012 14:40:59 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Richard http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-603 Richard Mon, 19 Apr 2010 22:03:00 +0000 http://blog.sucuri.net/?p=38#comment-603 @ Peter <br /><br />http://blog.networksolutions.com/2010/wordpress-is-not-the-issue/<br /><br />"WordPress is not the issue.<br /><br />by Shashi Bellamkonda on April 14, 2010<br /><br />We wanted to respond to the debate and conversations about the recent incident affecting Network Solutions’ WordPress customers. Recently, our customers have complained about malicious code on certain of their blogs hosted by Network Solutions. This was not an issue with WordPress. Sorry to the WordPress community and customers for any misunderstanding. This issue resulted from a complex combination of factors and we own it. We have taken steps to address this issue and we continue to work to protect our customers. Also we wanted to let you know that no personal or sensitive financial information was taken as a result of this issue.<br /><br />We are learning from this experience. By the way, we like WordPress and continue to use it for a lot of Network Solutions properties such as this blog. Network Solutions customers that need any assistance feel free to email us at listen @ networksolutions.com" @ Peter

http://blog.networksolutions.com/2010/wordpress-is-not-the-issue/

"WordPress is not the issue.

by Shashi Bellamkonda on April 14, 2010

We wanted to respond to the debate and conversations about the recent incident affecting Network Solutions’ WordPress customers. Recently, our customers have complained about malicious code on certain of their blogs hosted by Network Solutions. This was not an issue with WordPress. Sorry to the WordPress community and customers for any misunderstanding. This issue resulted from a complex combination of factors and we own it. We have taken steps to address this issue and we continue to work to protect our customers. Also we wanted to let you know that no personal or sensitive financial information was taken as a result of this issue.

We are learning from this experience. By the way, we like WordPress and continue to use it for a lot of Network Solutions properties such as this blog. Network Solutions customers that need any assistance feel free to email us at listen @ networksolutions.com"

]]> By: Peter http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-604 Peter Mon, 19 Apr 2010 10:01:29 +0000 http://blog.sucuri.net/?p=38#comment-604 changing your passwords and siteUrl won't do u any good - the virus will strike back, it's a bug in wordpress... <br /><br />WE NEED SOLUTION from the guys from Wordpress.org changing your passwords and siteUrl won't do u any good – the virus will strike back, it's a bug in wordpress…

WE NEED SOLUTION from the guys from WordPress.org

]]> By: Anonymous http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-605 Anonymous Fri, 16 Apr 2010 09:24:46 +0000 http://blog.sucuri.net/?p=38#comment-605 Fyi.<br />I had fixed the site url in the mysql db. Changed all sql/wp passwords.<br />See topic. http://wordpress.org/support/topic/385477/page/4?replies=53 Fyi.
I had fixed the site url in the mysql db. Changed all sql/wp passwords.
See topic. http://wordpress.org/support/topic/385477/page/4?replies=53

]]> By: Anonymous http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-606 Anonymous Tue, 13 Apr 2010 15:33:44 +0000 http://blog.sucuri.net/?p=38#comment-606 @WPSecurityLock: Sites where WordPress was installed manually were hacked too. @WPSecurityLock: Sites where WordPress was installed manually were hacked too.

]]> By: WPSecurityLock http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-607 WPSecurityLock Sun, 11 Apr 2010 09:59:35 +0000 http://blog.sucuri.net/?p=38#comment-607 Do we know if WordPress was installed using Fantastico on the affected sites?<br /><br />Has anyone checked both the siteurl (ID 2) and home (ID38) inside the wp_options table?<br /><br />I suggest changing the database table prefix to help limit the hacker roadmap too.<br /><br />Hopefully the entry point will be found out soon.<br /><br />Thanks for keeping us updated!<br /><br />Regina Smola Do we know if WordPress was installed using Fantastico on the affected sites?

Has anyone checked both the siteurl (ID 2) and home (ID38) inside the wp_options table?

I suggest changing the database table prefix to help limit the hacker roadmap too.

Hopefully the entry point will be found out soon.

Thanks for keeping us updated!

Regina Smola

]]> By: kurt http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-608 kurt Sat, 10 Apr 2010 07:24:37 +0000 http://blog.sucuri.net/?p=38#comment-608 I took a site that was hosted on Netsol and moved it to a new server 4/9. I cleaned everything I could find and restricted the permissions on htdocs. Today (4/10) it remains clean. I took a site that was hosted on Netsol and moved it to a new server 4/9. I cleaned everything I could find and restricted the permissions on htdocs. Today (4/10) it remains clean.

]]> By: Cometcom1 http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-609 Cometcom1 Fri, 09 Apr 2010 20:13:59 +0000 http://blog.sucuri.net/?p=38#comment-609 Curious to hear if anyone noticed the networkads.net domain change to other domain names? It seems to me that this is currently happening.<br /><br />Any other places that this has been found? - i.e. network solutions can't be the only place where this is happening. Curious to hear if anyone noticed the networkads.net domain change to other domain names? It seems to me that this is currently happening.

Any other places that this has been found? – i.e. network solutions can't be the only place where this is happening.

]]> By: Mike http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-610 Mike Fri, 09 Apr 2010 18:39:48 +0000 http://blog.sucuri.net/?p=38#comment-610 Got my site back. (How? Beats me.) Changed WP password, posted, everything seems OK. Already changed database password. Judging only on looks, everything appears fine. Will add extra protections, but will it help? Got my site back. (How? Beats me.) Changed WP password, posted, everything seems OK. Already changed database password. Judging only on looks, everything appears fine. Will add extra protections, but will it help?

]]> By: Berry Langerak http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-611 Berry Langerak Fri, 09 Apr 2010 17:46:32 +0000 http://blog.sucuri.net/?p=38#comment-611 Figured it might be nice to hear a different sound for once: the Wordpress (2.9.2) site that I host, doesn't have any malicious site_url settings, so it might be limited to a cluster of wordpress installation. Figured it might be nice to hear a different sound for once: the WordPress (2.9.2) site that I host, doesn't have any malicious site_url settings, so it might be limited to a cluster of wordpress installation.

]]> By: Emerson http://blog.sucuri.net/2010/04/mass-infection-of-wordpress-blogs-at-network-solutions.html/comment-page-1#comment-612 Emerson Fri, 09 Apr 2010 17:21:29 +0000 http://blog.sucuri.net/?p=38#comment-612 Great Shashi,<br /><br />If this isn't a problem specific to Network Solutions we'll know soon enough when you guys (or the Wordpress community) find which code is letting this happen! Great Shashi,

If this isn't a problem specific to Network Solutions we'll know soon enough when you guys (or the WordPress community) find which code is letting this happen!

]]>