You know when your brain is just not co-operating when you type ls into the mysql client console.

Far from having a hardcore readership in Russia, I learned the hard way that running a custom WordPress installation invites hackers to manipulate its fallible security measures. It would seem that the variety of users signing-up with a .ru address have figured out how to inject php code into wordpress, and my 2.8.2 version was riddled with custom javascript, php code and lots of messages about those little blue pills that can do so much for your sex life. I have to hand-it to whoever it was, that they took the time at all to suss out the flaws and use wordpress for such a lofty goal. They even managed to get a PHP file uploaded to the application, which is both alarming and annoying.

In the end, I decided that caution was the best policy, and installed a completely fresh installation of WordPress. I’ve now disabled users (not really sure of the point of them anyway), and added HTTP authentication to my /wp-admin directory. Its now been a couple of quiet weeks, so I’m taking this to mean victory for now.

I suppose this is the main issue of using open-source software; if you find an exploit, you can cruise around the web, looking for older, vulnerable installations and attack them. The customised code of many of the websites I’ve seen are probably far more vulnerable, but their uniqueness brings a form of security of its own- its too much work for script kiddies to figure out the dynamics of every site on the web, and after all, who cares if you hack Dan Garland’s blog; better-off chasing after Disney and Microsoft, where all the geek kudos would be.
Clean-up
For anyone out there who has experienced a hacked wordpress installation and wants to clean it up, these are the steps I took:

When working in ruby on rails 2.0.2 I keep my development database in the default sqlite3 but use mysql for the production database on a seperate test server. I found that after a while of use from my alpha-testers, the test server database for my web app had been filling up with useful, real-life data, that I wanted to use on my development environment. So I needed a way to transfer the data from mySQL (5.0.32) into sqlite3.

I exported the data from mySQL using the mysqldump utility. The mysqldump tool is normally used for backing up mySQL databases, but with a but of cunning can be used to export data into other formats. Firstly, since my sqlite3 development database already exists and can be recreated from the rake migration scripts, I didn’t need any of the SQL statements that modify or create the schema. You can tell mysqldump that with the –no-create-db and –no-create-info arguements to mysqldump:
mysqldump –no-create-db –no-create-info yourdatabase
Secondly, mysqldump uses its comma-seperated INSERT feature for brevity. However, sqlite doesn’t like this, so I wanted it to use a sepereate INSERT statement for each row. This is done with the –extended-insert=0 option
mysqldump –no-create-db –no-create-info –extended-insert=0 yourdatabase
Lastly, I wanted to ignore any of the comments or locking statements and output only those INSERT statements into a file. I did this using grep and piping the output:
mysqldump –no-create-db –no-create-info –extended-insert=0 yourdatabase | grep ‘INSERT’
you can then redirect this output into a file
mysqldump –no-create-db –no-create-info –extended-insert=0 yourdatabase | grep ‘INSERT’ > yourdatabase.sql
The one problem that I found with this output was that sqlite3 handles escape characters differently from mySQL, so I had to manually replace any instances of \’ with ” using my text editor.

This yourdatabase.sql file then contains a load of INSERT statements. Since I didn’t need the data in my development database anymore, I decided that the easiest thing to do would be to just delete the db/development.sqlite3 database and use rake to rebuild the schema, to leave me a clean, empty database. This avoids problems such as clashing primary key entries.
rm db/development.sqlite3
rake db:create
rake db:migrate
Finally, to import my data into sqlite3 I used the .read command in the interactive command-line tool
.read yourdatabase.sql