So it was setting that badness for anything that was a bot, and didn’t have a cookie set. So even if you figured out the half of it (only happens for bots) and pretend to be a bot, if you accepted a valid cookie it would give you the correct code anyway.
Basically a way to confuse the heck out of site owners and *still* get their spammy links indexed on all the major search engines.
Yayyy!! Apparently I ignored the strangeness and concluded that the economic downturn forced you to start hawking Cialis and Vioxx in order to support your yoga habit instead of, you know, checking the actual blog. It’s like Christmas in July with all of these unread posts. Welcome back to Google Reader!
3 Comments
What was the issue? I’m curious about what distinguishes Google Reader from other RSS aggregators.
I’ll put up a more detailed post in a few days, but the crux of the hack came down to this expression:
if(preg_match(“/bot|google|slurp|bing|msn|charlotte|crawl|yahoo|search|spider|inktomi|ask|alexa|seek/”,$_SERVER["HTTP_USER_AGENT"])&&sizeof($_COOKIE)==0){
add_action(‘the_content’,'echo323′);
add_action(‘wp_footer’,'echo123′);
}
So it was setting that badness for anything that was a bot, and didn’t have a cookie set. So even if you figured out the half of it (only happens for bots) and pretend to be a bot, if you accepted a valid cookie it would give you the correct code anyway.
Basically a way to confuse the heck out of site owners and *still* get their spammy links indexed on all the major search engines.
Yayyy!! Apparently I ignored the strangeness and concluded that the economic downturn forced you to start hawking Cialis and Vioxx in order to support your yoga habit instead of, you know, checking the actual blog. It’s like Christmas in July with all of these unread posts. Welcome back to Google Reader!