What kind of exploit is this?

Discussion in 'Security' started by muks, Nov 22, 2009.

  1. #1
    Please help me as I've been trying to figure this out for hours now. Sorry for my english and I hope it makes sense.

    My sister is running a wordpress blog that I'm hosting in my server and she called me yesterday telling me that someone copied her blog and I thought well maybe it's just a scraper and I'd fix it when I get home. When I got home I noticed that everything is the same except for the footer and every occurrence of the URL of my sister's blog was replaced with the other site's URL. Not only that, every changes I made with my sister's blog was also reflected to the other site. I also tried rebooting my server so that my sister's blog would be inaccessible and the other site was also inaccessible. I deleted the files of my sister's blog and the other site also got the same. I tried changing the wordpress theme and surprisingly the other site also changed with the same theme except for the custom footer. I investigated a bit further and found out that the registrar of that domain also owns other sites that clones other web sites as well.

    Examples

    ==

    original: http://www.roadfly.com/

    clone: http://www.mikm.com/

    ==

    original: http://www.traveleguides.com/

    clone: http://travelguides4u.net/

    ==

    original: http://www.celebritygossip.com/

    clone: http://www.flytones.com/

    All of the clone sites are hosted on softlayer. This is just not a case of site scraper as every changes you make with the original site will be reflected to the clone and I don't think it's exclusive to wordpress sites either.

    Now my question what kind of expoit is that and how do you prevent him/her from doing that? :eek:
     
    muks, Nov 22, 2009 IP
  2. live-cms_com

    live-cms_com Notable Member

    Messages:
    3,128
    Likes Received:
    112
    Best Answers:
    0
    Trophy Points:
    205
    Digital Goods:
    1
    #2
    Very interesting, but I don't have an answer.
     
    live-cms_com, Nov 22, 2009 IP
  3. ads2help

    ads2help Peon

    Messages:
    2,142
    Likes Received:
    67
    Best Answers:
    1
    Trophy Points:
    0
    #3
    Perhaps the clone site loads your pages, replace all your site url with his url, change the footer, then output to browser. This can be easily done in PHP.

    No perfect way to prevent site scraper but maybe you can trace the clone's IP and block it? Just a thought.
     
    ads2help, Nov 24, 2009 IP
  4. live-cms_com

    live-cms_com Notable Member

    Messages:
    3,128
    Likes Received:
    112
    Best Answers:
    0
    Trophy Points:
    205
    Digital Goods:
    1
    #4
    True, it's easy. It's a bad long term strategy considering the website's he's sraping can easily block his IP, and instantly the traffic he's built up would be wasted. But it's an easy strategy short term.
     
    live-cms_com, Nov 24, 2009 IP
  5. MakeMoneyTutor

    MakeMoneyTutor Peon

    Messages:
    247
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    haha heard first time amazing :)
     
    MakeMoneyTutor, Nov 24, 2009 IP
  6. yng1chris

    yng1chris Peon

    Messages:
    55
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #6
    How did you find out he was copying your site?
     
    yng1chris, Nov 24, 2009 IP
  7. Vinsar

    Vinsar Active Member

    Messages:
    100
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    53
    #7
    Try to block the offending site's IP.
     
    Vinsar, Nov 24, 2009 IP
  8. SecureCP

    SecureCP Guest

    Messages:
    226
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #8
    Block the clone's ip in your firewall, but first contact their upstream provider with evidence, also file a DMCA notice.
     
    SecureCP, Nov 24, 2009 IP
  9. Drizzy

    Drizzy Guest

    Messages:
    78
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #9
    I would say take legal action if this cloning continues.
     
    Drizzy, Nov 24, 2009 IP
  10. kbduvall

    kbduvall Peon

    Messages:
    71
    Likes Received:
    3
    Best Answers:
    4
    Trophy Points:
    0
    #10
    Without researching it too much, I found a Wordpress plugin that allows domain mirroring. You can check out the plugin at wordpress .org/extend/plugins/domain-mirror/
     
    kbduvall, Nov 28, 2009 IP
  11. papsyface

    papsyface Peon

    Messages:
    13
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #11
    As the other people have mentioned above, legal action is one option (depending on your/his location, local laws, etc). As for blocking the bot's IP - that very likely wouldn't do anything. IP bans are ineffective and have been for many many years. Instead, I'd recommend looking for any type of pattern in how the bot functions and then use that to your advantage. A blatant IP ban is going to be circumvented, so I'd recommend not being so obvious about being onto him.

    Personally, I'd take advantage of the fact that he's duplicating your content. For example, throw a check in your header to see if the user accessing the current page is the bot (based on IP, user-agent, or anything else that may be specific to him). If the result is true, echo out a meta tag:

    <meta name="robots" content="noindex,noarchive">

    That way, he likely won't catch on but as soon as google sees that - his site will be gone from the results for at least 3 months [from the time he catches on, indefinitely until then].

    The possibilities with that method are endless, you could also echo out all of the things that you know violate most search engines terms/guidelines, such as cloaking, adding malware, etc etc. If done properly, you could likely get his domain banned from all major search engines. That'd give you more time to work out how you're actually gonna deal with it, if him being banned isn't enough for you.
     
    papsyface, Nov 28, 2009 IP
  12. kbduvall

    kbduvall Peon

    Messages:
    71
    Likes Received:
    3
    Best Answers:
    4
    Trophy Points:
    0
    #12
    That's a good point. You could definitely mess with him. You could post obscene content to his site possibly getting him banned by his hosting company or you could display messages to his users.

    Don't forget about contacting his web host. There aren't many who don't take this kind of thing seriously. I'd email their abuse department.
     
    kbduvall, Nov 28, 2009 IP
  13. ads2help

    ads2help Peon

    Messages:
    2,142
    Likes Received:
    67
    Best Answers:
    1
    Trophy Points:
    0
    #13
    Lol. You can do:

    if ( ip == clone's ip ) {
    echo obscene content;
    die();
    }
    PHP:
    Have a try? :)
     
    ads2help, Nov 28, 2009 IP
  14. papsyface

    papsyface Peon

    Messages:
    13
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #14
    Are you just upping your post count, ads2help? You repeated pretty much the exact same thing kbd said.

    Another idea: add the offending site's domain to your webmaster tools account, and choose the meta tag method. Then when they duplicate your content, they'll unknowingly be verifying the site for you. That'll give you some quick control over the site without having to wait for SEs to propagate the changes.
     
    papsyface, Nov 28, 2009 IP
  15. Kwaku

    Kwaku Well-Known Member

    Messages:
    1,217
    Likes Received:
    45
    Best Answers:
    0
    Trophy Points:
    140
    #15
    Call Softlayer, explain the case and have them close down their server. I did, works fine. You have proof he is cloning as you can give them the next article you will post, show that it appears on your side and a bit later on theirs.
     
    Kwaku, Dec 6, 2009 IP
  16. Drizzy

    Drizzy Guest

    Messages:
    78
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #16
    Could this be an iframe trick of some sort?
     
    Drizzy, Dec 8, 2009 IP