YugaTech | Philippines, Tech News & Reviews

Several blogs on our lot was target of defacements earlier this morning. Two were Connie’s food blog, one of Chin Wong along with two others. It’s always a dreaded thought that one of your sites or even servers getting hacked by some punk from Russia (or where ever).

I first got notice of the series of defacements last night while updating of our blogs on that server. Only one page was defaced and that’s the readme.html of the stock WordPress installation file. It was obvious how it was done because the file has write permissions for basically anyone to tamper with (chmod+666). Deleting the file and checking permissions of other files and folders was the logical move to fix that. And I thought that was all of it.

Or so I thought. Early this morning, we got calls that there were other defacement on the same server — 4 more blogs running on WordPress and Expression Engine. I really thought the entire server was compromised so we had to spend the entire day checking practically hundreds of other sites on that same rig. Though we’re still not 100% sure exactly how all these happened at the same time but evidence of cross-site scripting and improper folder permissions were the primary reasons.

How to prevent this in the future:

• Check your blog/sites for improper file/folder permissions. The plugins folder or the themes folder of your WordPress account is the more common entry-point.
• Check registration access levels – leave them at Subscriber level if possible.
• Always check for newer updates. EE had a vulnerability report posted last January so if you’re not aware of them, do regularly check your blogging software provider for updates, patches and other fixes.
• Always have a local copy of your DB and your files. For WP, there’s a DB Backup plugin for this and always have your existing themes in your PC. Will be helpfull when the time comes.

I’m sure we’d get some heat from this but battling hackers, spammers, and phishers is no easy task and a continuous effort. We get literally dozens of brute force attacks everyday and all we can do is be alert as ever. Any provider saying they’re 100% hack-proof is only asking to be targetted by more attacks.

All we can do is learn from this incident, be more carefull and move on.

PinoyExchange (PEx) is probably one, if not the oldest, of the commercial sites in the Philippine cyberspace that breezed thru the dotcom boom and survived the bust. With memberships of 171,729 and 15,258,823 posts since July 1999, PEx could very well be the second biggest site in the country in terms of traffic next to Inq7.net.

There’s no available public stats for PEx but a quick check with Alexaholic showed it’s neck-in-neck with PhilStar for the second spot.

Still, despite the relative success in the online business, PinoyExchange is still under the red and funds are always short (mainly from advertising and co-branding). The site is currently suffering from slowdowns/overload and the admins admit they could not upgrade the servers because there’s no available funds for it.

I’m not sure how many servers they have but I reckon it could be around 2 or 3 costing as much as Php50,000 in monthly hosting cost. That’s on top of the cost of operation and salaries of the admins, sales and marketing people. So you’re looking at a conservative estimate of Php 300,000 monthly burn rate.

They’ve already scrapped AdSense altogether so I guess they’re not earning enough from the real estate it used to occupy. What’s getting a lot of heat right now are the huge ads that came along with the Server Busy page (makes people think they’re doing it to pad ad impressions). Another option they will be trying is “interstitial ads” which is similar to what you get in YahooGroups (much like an 8-second pause for an ad when you flip pages).

Active users are now suggesting that maybe the subscription model alongside the advertising model would help ease the cash-strapped forum/community. They used to have PEx Plus+ which is an annual subscription for premium members a few years back but they discontinued it. I think it’s time to revisit that idea. With over 170,000 registered members (ok, there’s a lot of multiple and dead accounts in there), even if only 2% of that are premium subscribers paying Php50 a month, that’s already Php170,000 — more than enough to quadruple (4x) their server capacity with some spare change for a good Web 2.0-ey redesign.

Of course, the rest of the 98% of the members will still have the free and basic services they get from PEx, maybe with the search function enabled as well.