Godlike Productions - Discussion Forum
Users Online Now: 2,162 (Who's On?)Visitors Today: 1,138,304
Pageviews Today: 1,542,921Threads Today: 397Posts Today: 6,359
12:27 PM


Rate this Thread

Absolute BS Crap Reasonable Nice Amazing
 

Have a Coding Question For Any Tech Geeks Please... Have I Been Hacked?

 
Anonymous Coward
User ID: 24158123
United States
10/25/2013 11:34 AM
Report Abusive Post
Report Copyright Violation
Have a Coding Question For Any Tech Geeks Please... Have I Been Hacked?
I have a WordPress site. Just today, when I approve comments for visitor's posts, this code gets inserted automatically after the commenter's email address (which I remove, obviously, before approving):

* <![CDATA[ */(function(){try{var s,a,i,j,r,c,l,b=document.getElementsByTagName("script");l=b[b​.length-1].previousSibling;a=l.getAttribute('data-cfemail');i​f(a){s='';r=parseInt(a.substr(0,2),16);for(j=2;a.length-j;j+=​2){c=parseInt(a.substr(j,2),16)^r;s+=String.fromCharCode(c);}​s=document.createTextNode(s);l.parentNode.replaceChild(s,l);}​}catch(e){}})();/* ]]> */

Can anyone tell me what this is?

And, most importantly, how to stop this?
Anonymous Coward
User ID: 47160486
United States
10/25/2013 11:43 AM
Report Abusive Post
Report Copyright Violation
Re: Have a Coding Question For Any Tech Geeks Please... Have I Been Hacked?
Yes dig in your comments.php file and try to locate something that looks md5 encrypted. Best work with an ftp for this. It could be encrypted code also served by an inserted js file reference, so review your head section completely. Finally probably an outdated script someplace on your plugins so go see which ones got active exploits ( just search exploit and plugin name) and update or switch out ta any security risks. Also ensure your on the latest wp version.
Anonymous Coward (OP)
User ID: 24158123
United States
10/25/2013 12:03 PM
Report Abusive Post
Report Copyright Violation
Re: Have a Coding Question For Any Tech Geeks Please... Have I Been Hacked?
Yes dig in your comments.php file and try to locate something that looks md5 encrypted. Best work with an ftp for this. It could be encrypted code also served by an inserted js file reference, so review your head section completely. Finally probably an outdated script someplace on your plugins so go see which ones got active exploits ( just search exploit and plugin name) and update or switch out ta any security risks. Also ensure your on the latest wp version.
 Quoting: Anonymous Coward 47160486


Awesome. Thank you.
Anonymous Coward
User ID: 44809075
United Kingdom
10/25/2013 12:35 PM
Report Abusive Post
Report Copyright Violation
Re: Have a Coding Question For Any Tech Geeks Please... Have I Been Hacked?
Hey OP,

This is really common, especially on WP sites that are not updated regularly. If you still have trouble add me on skype (akelly-uk) and I can help you get this fixed.


Cheers,
Anonymous Coward (OP)
User ID: 24158123
United States
10/25/2013 01:17 PM
Report Abusive Post
Report Copyright Violation
Re: Have a Coding Question For Any Tech Geeks Please... Have I Been Hacked?
Hey OP,

This is really common, especially on WP sites that are not updated regularly. If you still have trouble add me on skype (akelly-uk) and I can help you get this fixed.


Cheers,
 Quoting: Anonymous Coward 44809075


Thanks. I really appreciate your offer to help. I ended up disabling it and installing a new commenting plugin. Do you think that's sufficient or should I dig into it further and make sure it's not been further compromised?





GLP