In the beginning was Netscape Gold. Then Mozilla Composer. From the ashes of Netscape and the code of Mozilla Composer came Nvu. Nvu had a cousin, KompoZer. But all this tools now belong to History and are extinct or on path to extinction.

In the meantime, Mozilla brought Firefox to the masses and its rendering engine, Gecko, has the power to fuel a next-generation wysiwyg editor for the World Wide Web. This editor is BlueGriffon™. Stay tuned!

When I tried to login to the administration interface I was told that my WordPress database needed upgrading. I thought "That’s weird!"

Some further investigation revealed that someone managed to upload a PHP script called ro8kfbsmag.txt (MD5 sum df3b74cd38c717d9d7bbf0cd1910baa1) to my /tmp directory. It starts like this:

<?php
/*Magic Include Shell by Mag icq 884888*/
//TODO: ñëèòü ôàéëî íà ñâîé ôòï (!)
$ver='2.1';
if(isset($_GET[pisun233]))
{

This gave me enough information too start googling. A must-read is Detailed Post-Mortem of a Website Hack Through WordPress & How To Protect Your WordPress Blog From Hacking, as it describes a very similar attack. There is also a support thread at wordpress.org: Weird and Dangerous : ro8kfbsmag.txt.

The attack vector on my server looked like this, originating from 78.109.21.80 with HTTP/1.0 as protocol version and "Opera" as User-Agent. I wish I logged POST data!

POST /wp-admin/options.php
POST /wp-admin/upload.php
POST /wp-admin/options.php
POST /wp-admin/options.php
POST /wp-admin/inline-uploading.php?post=-1&action=upload
POST /wp-admin/options.php
POST /wp-admin/options.php
POST /wp-admin/upload.php?style=inline&tab=upload&post_id=-1
POST /wp-admin/upload.php?style=inline&tab=upload&post_id=-1
POST /wp-admin/options.php
POST /wp-admin/options.php
GET /wp-admin/upgrade.php?step=1

Needless to say, I have restored a backup and taken certain precautions to prevent this from happening again.

One of the interesting quotes is:

Project Zero’s Chief Architect is one of the first IBMers to admit in public that Java today can be considered as a system language and is not desirable for building RESTful Web applications [...]

This was apparently a bit out of context, according to the comment by Jason McGee, but fun to read nevertheless.

He makes a prediction that shall be interesting to see if comes true:

It has taken over 10 years for the Java stronghold to admit Java’s poor ROI on the Web and with the current recession it is likely that many Java customers are going to be making more informed investments. As a result there will be considerable rise in uptake of dynamic languages.

I noticed yesterday that I could not visit The Daily WTF or Podomatic. Today I started investigating and __henke__ in #data on irc.freenode.net told me that my ISP Telia and Cogent Communications had stopped peering.

Related links in approximately chronological order:

• The Telia-Cogent Spat Could Ruin the Web For Many (gigaom.com)
• Cogent depeer’er Telia (sunech.com)
• Amerikansk operatör stoppar Telia (idg.se, in Swedish)
• Update Telia och Cogent i uppgraderingsbråk (idg.se, in Swedish)
• Update Cogent: "Telia bröt mot kontraktet" (idg.se, in Swedish)
• Update Information om stängda förbindelser mellan Telia och Cogent (telia.se, in Swedish)
• Update Cogent CEO: Peering Breakdown Is Telia’s Fault (gigaom.com)

The networks affected are AS1299 (TeliaSonera International Carrier, TSIC) and AS174 (Cogent Communications). 

Update It seems like www.webservertalk.com is unreachable for the same reason.

client denied by server configuration: /directory/image, referer: junomsg://028985E8/

(I replaced the filesystem path to the image with /directory/image.)

What kind of protocol is junomsg? I did some research and it seems like this comes from the “Juno offline email client”. Someone probably received a link to my site by mail and the offline client seems to run in Internet Explorer. Case closed.