Security News

Cyber-criminals regularly use blogs and other small web sites to serve spam and phishing pages. And the Flashback malware was, in part, distributed by infected WordPress blogs. An article on the Unmask Parasites blog looks at the techniques that cyber-criminals use to infect web sites.

Often, these spammers and malware writers get access to a web site by using “brute force” attacks to guess administrators’ passwords. This means that they use computer programs that can try thousands, even millions of passwords to get in. Once they have access, they create sub-directories on the blog’s server to store their pages. They may even fully take over a blog by installing their own version of the software.

When this is done, they set up pages that are either used in links in spam e-mails, or phishing pages, web pages that look exactly like the login page for a bank, or for a web site such as PayPal.

So what can you do? At the end of the article linked above, there are a number of suggestions. One of the most useful it to use a strong password; don’t use any words that are in a dictionary, and combine numbers with both lower-case and upper-case letters.

Next, check your blog’s server to see if there are any directories or sub-directories containing files that you didn’t upload. Other techniques include using Google’s webmaster tools and advanced Google searches to check what type of content is on your blog.

Finally, make sure your blog’s software is up to date. On your dashboard, you’ll see whether there are updates that need to be installed. When you see these, update them right away to protect against known vulnerabilities.

There are millions of blogs around the world, and many of them are vulnerable. Make sure your blog isn’t spreading spam, phishing pages or malware.