I have confirmed that www.drroyspencer.com has been hacked and rendered inoperable.
Dr. Spencer confirms this in an email exchange with me this AM and writes:
“Apparently some Indonesian female hacker.”
Whether this is a direct attack on his views about climate, an indirect attack via a hired gun, or just some kid looking to hold up a trophy for others to see is unclear at this point.
It does point to the risks though of running an independent server. My best advice to anyone in the climate issue is to run on wordpress.com rather than an independent server as they keep everything running smoothly and up to date against the latest security threats.
lsvalgaard says:
February 28, 2013 at 10:57 am
lucia liljegren (@lucialiljegren) says:
February 28, 2013 at 10:03 am
Gabby just injected something that’s preventing it from displaying.
Isn’t the bigger issue how she did that on Roy’s local server?
============
Gabby-gate ?
(someone knows more than they used to).
It’s working here in Australia the modern home for all those who seek to restrict free speech and absolutely anything that questions the Global Warming faith. As an aside those of you used to old politicians may be interested in this conservative candidate for a Sydney electorate
http://blogs.news.com.au/heraldsun/andrewbolt/index.php/heraldsun/comments/gillards_foe_in_the_battle_of_rooty_hill/
lsvalgaard says:
If you want to recover the site, the biggest issue is what has been done to the contents of the server. If you want to protect in future, how the hack was accomplished is the more important issue. Knowing that can help you prevent it. And of course, if you were law enforcement, both would probably be important. You’d probably also what to know when it occurred and know the IP connections and such like.
If Roy is going to self host– as I do– he should get ZBblock and install it. ZBblock gives a lot of protection against XSS attacks, and various sorts of hacks. It’s not perfect but it takes care of lots of WordPress’s insecure features of which there are plenty for self hosted installations.
There are occasional incompatibilities between ZBblock and WordPress (I hit one when approving some moderated comments. I have to tell the developer). But ZBblock will give a great deal of protection. I have some other advice for Roy too. But… I’d give that only if he wants it.
sorry. the CruTape letters is already taken as a title.
And yes, CS lewis was the inspiration
Let’s pause and give credit to WordPress, by the way, for their readiness to host and support sites with a vast multiplicity of views.
DirkH,
“At least officially, the EU doesn’t have an equivalent to the Patriot Act – for the time being. That doesn’t mean Eurocrats are nice people; maybe they’re just slow.”
Or maybe they think that they already have the power the US Gov gained from the Patriot Act, so an EU equivalent isn’t necessary.
Random or targeted? That would be my primary concern.
Any anti-skeptic claims of responsibility for the attack on Spencer’s site being made in the small dark backwaters of the slacker / hacker blogs?
Let’s peek and poke around a little . . . . eh eh eh.
John
ZootCadillac says:
February 28, 2013 at 12:01 pm
“…Forgive me I’m returning from a friend’s funeral )
All in all it’s a grave inconvenience…”
I saw what you did there!
I postulate that the only viable career for persons under 24 is as activist; unless you think part-time service employee is a career.
@John Whitman
Random.
I found 11 sites currently running the script last night when made aware of it. Many more over the course of about a year. the only thing that they have in common? their vulnerability to this script.
It’s kids saying ” hey, your security is crap” and showing you why. Nothing more.
and at the end of the day if your security won’t deal with a script that has been going around for over a year then yes, it is crap*. Time for a wake up.
*With the greatest of respect to Dr Spencer as I certainly don’t expect anyone but his army of minions to deal with this 🙂
Up and running again.
Get used to it, AGW causes increased internet hacking…:)
Didn’t Barack Obama come to America from Indonesia?
= = = = = = =
ZootCadillac,
Thanks for your quick research in some of the corners of slacker / hacker land.
Random does seems a plausible explanation for the hack of Spencer’s site at this point without further info.
John
Hands up – WHO wants to host their own website and spend the time and effort to ‘battle’ the script kiddies, insure updates are installed and generally ‘supervise’ the whole technical affair including daily readings the ‘hack’ logs?
Not I … not my core business nor would I want it to be …
.
The AP’s Seth Borenstein reports that increases in hacking are completely consistent with climate change.
🙂
One might be inclined to think that exposing a ‘physical’ LAN port directly to the internet on an MS-OS-box is an insane thing to do; there are task-specific firewall ‘boxes’, of course, capable of operating at LAN line rates that trap and censor malformed traffic or any other outright hacking attempts, screening out low-level protocol hack ‘attempts’ before supplying arriving packets to the MS-OS-box … of curse, any legitimate-appearing, properly-formatted packets may be destined to ‘disrupt’ an otherwise operating ‘task’ on said MS-OS-box are another story …
.
ZootCadillac says:
February 28, 2013 at 12:01 pm
This is part of an ongoing attack from a basic script in the wild.
IMHO one should fault anybody for not ‘running the latest and greatest security’ stuff. As far as I know [correct me if I’m wrong] the Gabby script works because Firefox did not prevent XBL bindings from remote locations in the same way it prevents other active content. This was a bug in Firefox and that is where the blame should be laid. Perhaps this goes back to a flaw in the design of CSS stylesheets. in which case blame moves there. Personally, I’m pissed that one has to ‘protect’ against flaws that should never have been allowed in the first place. Many such things might have been introduced to allow commercial interests to control [‘enhance’ as it is called] your ‘experience’ when visiting their websites.
I’m one of the “bedraggled IT types who no doubt periodically help him with this stuff” … haha! Truth is that we let the WordPress updates get a little behind and they took advantage of one of the recent security vulnerabilities.
Everything is back up and running and please let Dr. Spencer know if anything is still awry. I added a security plugin that is very good and should help prevent this in the future, but of course WordPress security is a moving target. We’ll try to keep up on it going forward. Oh, and I made some fresh backups. 🙂
– Jamon (ClearSightStudio.com)
” or just some kid looking to hold up a trophy for others to see is unclear at this point.”
This is most likely the case. They run scripts to go search for sites with vulnerabilities, then work their vandalism on the results. I used to get hacked frequently, until I switched to Drupal for most of my sites. Hasn’t happened in 6 years.
IMNSHO, important web pages that must “always” be available are best served on dedicated servers running only a simple web server delivering only static web pages.
Maintaining “content” is then non-trivial. Not easy for the point-and-clickers.
WP, etc. provide convenient means of delivering content to a large readership that is fairly secure, albeit with substantial burdens of applicability of laws (as we can’t all be Richard Windsor) and the need to be rigorous about maintaining backups.
Where has Peter Gleick been during this time frame!
I’ve setup some self hosted sites…
Advice:
1. Use an Infrastructure as a Service (IaaS) provider. I use Linode.
2. Configure ssh to accept public key log in.
3. Disable root password, so only public key login works.
passwd -l
4. Purchase SSL cert.
5. Install SSL cert and ensure only readable by root.
6. Use postgresql rather than mysql for database.
I know there are fans of both, but postgresql is more standards compliant and doesn’t allow for certain kinds of sloppy programming behavior.
7. If email server — use these instructions:
http://theclimber.fritalk.com/post/2009/01/27/Tutorial-%3A-Setup-your-mail-server-%28courier-imap-postfix-postgresql%29
8. I don’t use WordPress… but postgresql can be used with WordPress:
https://wordpress.org/extend/plugins/postgresql-for-wordpress/
If anybody thinks that this will be investigated or the perpetrators prosecuted.
Don’t get your hopes up. Remember who runs the executive branch. The minions of “The Shrill One.”
[thanks]