<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Sneaky Bastard &#187; Security</title>
	<atom:link href="http://sneakybastard.com/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://sneakybastard.com</link>
	<description>Web Hosting for the Chemically Unstable</description>
	<lastBuildDate>Sat, 30 Oct 2010 17:25:57 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.4</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Quick WordPress Intrusion Detection</title>
		<link>http://sneakybastard.com/2009/09/quick-wordpress-intrusion-detection/</link>
		<comments>http://sneakybastard.com/2009/09/quick-wordpress-intrusion-detection/#comments</comments>
		<pubDate>Tue, 08 Sep 2009 02:17:23 +0000</pubDate>
		<dc:creator>joseph</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://sneakybastard.com/?p=390</guid>
		<description><![CDATA[
To satisfy my curiosity after the increase in worm activity affecting WordPress websites, I decided to run a quick query of the wp_users table in all the WordPress databases on a server. Adjust the database names as necessary, and create a MySQL password file as /root/.my.cnf before running the loop:

for U in adam baker charlie [...]]]></description>
			<content:encoded><![CDATA[<p>
To satisfy my curiosity after the increase in <a href="http://mashable.com/2009/09/05/wordpress-attack/">worm activity</a> affecting WordPress websites, I decided to run a quick query of the <kbd>wp_users</kbd> table in all the WordPress databases on a server. Adjust the database names as necessary, and create a MySQL password file as <kbd>/root/.my.cnf</kbd> before running the loop:
</p>
<p><code>for U in adam baker charlie delta; do<br />
&nbsp;&nbsp;DB="${U}_wordpress"<br />
&nbsp;&nbsp;echo "Database: $DB"<br />
&nbsp;&nbsp;sudo -H mysql -D $DB -e "<br />
&nbsp;&nbsp;&nbsp;&nbsp;SELECT u.user_login, u.user_registered, um.meta_value<br />
&nbsp;&nbsp;&nbsp;&nbsp;FROM wp_users u INNER JOIN wp_usermeta um ON (u.id = um.user_id)<br />
&nbsp;&nbsp;&nbsp;&nbsp;WHERE um.meta_key = 'wp_capabilities'<br />
&nbsp;&nbsp;&nbsp;&nbsp;ORDER BY u.user_registered DESC"<br />
&nbsp;&nbsp;echo ""<br />
done<br />
</code></p>
<p>
The output will show the most recently created user accounts for each WordPress installation. Apparently the current worm creates an administrator account called &ldquo;Administrator (2)&rdquo; that is used to login and make changes to the site. I don&#8217;t know if that string appears in the nickname field, or what, so I didn&#8217;t query for it explicitly.
</p></p>
]]></content:encoded>
			<wfw:commentRss>http://sneakybastard.com/2009/09/quick-wordpress-intrusion-detection/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

