Diagnosing a Pharma Hack

wordpress-bloggingToday’s post is not about filmmaking, but I hope it will be of use to other WordPress bloggers who have been the victims of so-called Pharma Hacking.

A few weeks ago I started to notice strange things happening on this site.

The first thing was that I couldn’t log in. At the top of the login screen there would be an error message similar to this one:

Warning: Cannot modify header information – headers already sent by (output started at /home/trustjho/public_html/blog/wp-content/themes/adspress/functions.php:74) in /home/trustjho/public_html/blog/wp-login.php on line 302

I googled the message and found various suggested solutions, but in the end the only one that worked was to reinstall WordPress.

The next issue was that the media gallery wouldn’t load. When I tried to upload a new image for a post it wouldn’t work, and I couldn’t see any of the images I’d uploaded previously. I tried all the usual WordPress troubleshooting – deactivating plug-ins and themes, which did nothing, and again reinstalling the core files. After the reinstall the problem went away for a little while, but soon came back.

The third thing I noticed was line breaks appearing after links in many of my posts. I checked the html code of the posts, but couldn’t see any reason for this behaviour.

Fourthly, and most worryingly, I started coming across a couple of weird sentences at the bottom of several blog posts – sentences which I didn’t write. It was always the same:

“Here what I remember even at that time when I sleep it Cialis Dosage which has to be fixed and can’t be. Cialis dose it is an important element of reception. Which it is necessary to remember.”

Both instances of the word Cialis were hyperlinks to a site selling the drug.

After hours of googling I figured out that I had been Pharma Hacked. Pharma Hacking involves uploading rogue code to your WordPress site which then inserts text and links into your posts. It also inserts javascript into the posts which renders the text and links invisible to human viewers, while still being visible to search engines. The result is that the linked drug site rises in search engine rankings because all these invisible links to it have been maliciously inserted into unsuspecting WordPress sites. Because the text is invisible, readers of the victim’s site and even the owner of the site may be completely unaware that it has been hacked.

When I looked at the infected posts in the ‘text’ view mode (as opposed to ‘visual’) I could see two additions, one at the start of the post:

<script type=”text/javascript”>// <![CDATA[
function get_style6610 () { return “none”; } function end6610_ () { document.getElementById(‘database6610’).style.display = get_style6610(); }
// ]]></script>

And one at the end:

<p id=”database6610″>Here what I remember even at that time when I sleep it <a href=”http://cialisdosage.biz/index.html”>Cialis Dosage</a> which has to be fixed and can’t be. <a href=”http://cialisdosage.biz/index.html”>Cialis dose</a> it is an important element of reception. Which it is necessary to remember.</p>
<script type=”text/javascript”>// <![CDATA[
end6610_();
// ]]></script>

Together the two pieces of javascript ensured that the text and link were not displayed. I’m still not sure why I was able to see the text on some of my posts when viewing my site’s front end, but it was lucky that I could otherwise I might never have diagnosed the problem.

After some more googling I downloaded Wordfence, a plug-in that scans your site for malicious code. Wordfence identified around eight or ten malicious files, which I immediately deleted. Straight away the media gallery started working again and the rogue line breaks after links disappeared.

Unfortunately Wordfence isn’t able to remove the text from your posts. I googled around for something that could, and in the end used a plug-in called Search and Replace. This was able to delete all instances of the sentence “Here what I remember….” and its hyperlinks, which turned out to be in over 900 of my 1,100 blog posts. I can’t remove the javascript, because the ID number in it (6610 in the example above) changes with every post, and I can’t find a search and replace plug-in that can handle a wildcard like that. However, without the text and links the javascript does nothing.

I still don’t know how my site got infected in the first place, but apparently the most likely route would have been through one of the old, out-dated plug-ins I was running. Evidently it is very important to regularly update not just WordPress but all of your plug-ins to make sure there are no security loopholes. And I will be performing regular Wordfence scans from now on to check for anything slipping through again.

Diagnosing a Pharma Hack

Heretiks: Day 25

The last day. A splinter unit is in a studio in Swansea shooting a body burn stunt, but I miss that because the main unit are shooting exteriors at Margam. There is heavy rain in the middle of the day and it becomes unsafe to do the chase scene amongst the trees that is scripted. I wander around the castle grounds with Paul, Bali the 1st AD and Mikey from locations in an effort to find somewhere safe but visually suitable in which to re-imagine the scene.
After lunch we find a path in the woods and Paul comes up with a way to stage it all in one dynamic steadicam shot. Rupert shoots it beautifully and as the daylight fades Bali calls a main unit wrap.
Many hugs and goodbyes later, I arrive at the studio to join the splinter unit for their last few hours. They are setting up a wire rig from a cherry-picker against a green screen to shoot FX elements of a creepy girl. While that is being rigged, 2nd unit DP Keefa is getting tight inserts of gory prosthetics on a table nearby, shooting on his Red Dragon and referring to main unit footage on a laptop so he can match my lighting.
Producer Mike asks me to shoot a green screen element of the creepy girl staring while the wire rig is being set up. Rupert and Max arrive with the Alexa and we hook up to the mix and overlay system. This keys out the green in real time and allows us to see the creepy girl against the plate we shot at Margam yesterday. She can’t see the monitor herself so she doesn’t know where she is. I ask her to take two steps to her left. It is EXACTLY like Knightmare. Welcome, watchers of illusion.
Keefa takes over to shoot the wire rig stunt, while I work with Paul to shoot inserts. The art department have recreated little pieces of some of the sets in this cavernous studio space. We also shoot a prosthetic head cast of one of the lead actors having her eyes poked out. Lovely. Then we grab some more green screen elements, including fake blood spraying in various directions. Co-writer and prothestics make-up artist Conal is using a fire extinguisher to spray the blood. It goes everywhere.
We wrap at last, and I’m very glad I got to come along and do this last fun little bit at the studio.
Overall the project has been great, and a fantastic opportunity for me. With a budget ten times greater than anything I’ve previously worked on, and a much bigger crew, and the Alexa and Cooke S4s to play with for five weeks, and all those HMIs, I’ve been quite spoilt. All the other heads of department are older than me and have worked on huge TV shows, and I can safely admit now that I was incredibly nervous when we started, but everyone is very, very happy with how the film looks, including me. Hopefully it will lead to more good things.IMG_2966.JPG

Heretiks: Day 25

Heretiks: Day 24

Jimmy, one of the runners, has written a song about the shoot. He heard the 1st AD ask our steadicam operator, “Rupert, are you ready?” and that inspired him to go home and write and record a pretty awesome song. Some of the crew have been shooting a music video for it on a phone during the lunch-breaks.
We shoot in the corridor in the morning. Lots of chippies are waiting to break down the set as soon as we’ve finished on it. We move upstairs and once again reap the rewards of rigging the chapel lighting so thoroughly as we bash through a critical scene.
After work there is a pre-wrap party. A bunch of us end up at the holiday cottage where one of the actors is staying. The cottage has a VHS deck and a well-worn copy of Free Willy. Of course we put it on. Michael Ironside is in it.IMG_2952.JPG

Heretiks: Day 24

Heretiks: Day 23

More corridor and nun cell scenes today. Everyone is tired, including the actors, and as a result they need more help from the lighting to look good.
We fly out the wall that has the window in it, but we still need the light to look like it’s coming through the (off-camera) window. So the art department remove the window from the wall and the sparks rig it to a C-stand, surrounded by flags.
We do a fight scene involving a sharp item being used as an improvised weapon. We’re about to shoot a cool 2-shot of the actors struggling on the floor, dutched almost 90 degrees. But the point of the sharp item isn’t showing up on camera and looking threatening enough. We’re short on time, so I prop up two torches on my wallet on the floor behind the actors, to edge-light the weapon. Not the first shot I’ve lit with my torch, and it probably won’t be the last.
Just two days left now.IMG_2950-1.JPG

Heretiks: Day 23

Heretiks: Day 22

After 16 hours at home (half of those asleep) I returned to Wales late last night. Only four days of the shoot left, including today, and we’re powering through the material at a good lick. All the sets are rigged so it’s not hard for lighting, but we still have to be careful. We rush the first take of a close-up on one of the lead actors and she doesn’t look good. I insist on another take and we take five minutes to massage the lighting and help her out. It’s totally worth it. The DP has to make the cast look good, and the fact that the pressure was on from the 1st AD is not an excuse that the producers will give two hoots about when they watch the rushes.
We do more steadicam shots going from corridor to corridor and another 360 degree shot in the chapel. There are few easy shots with Paul and that’s a great challenge to meet. This shoot has given me a lot of confidence.
Today we shot over eight minutes of screen time. We’re all very chuffed about that.

IMG_2944-0.JPG

Heretiks: Day 22

Heretiks: Day 21

Christmas music is playing in the dining room as we eat breakfast. There is a deer feeding event featuring Father Christmas in the grounds of the castle today.
We shoot mostly in the cell and corridor again. For the first time we venture into a second corridor linked to the first. But this one has windows, so the guys put up a 6K and a 4K firing in from outside. We don’t have the space to back them off enough to match the light levels of the adjacent “candlelit” corridor. So we rig up the iris motor and I do a stop pull from about T2.8 to T5.8 as Rupert steadicams from the darker corrridor to the brighter one.
Sometimes when you set up for a scene you put in lights through the obvious windows and it just looks great straight away. Today there were a lot of scenes like that. Half the battle is getting your backlight in without the lamp being in frame. Then it’s coming in with a key that’s sidey enough to have shape. If you’re doing the kind of spinning steadicam shots Paul loves it can be very difficult not to have somewhere in the move where the lighting looks flat. Today the coverage was a little more conventional and that really helped.
In our last hour we move up to the chapel and bash out a small scene in three set-ups which all look great. The camera and lighting teams move like well-oiled machines so I can deliver the goods in record time.
We wrap five minutes early and I’m off like a shot with a runner/driver to the station. I’m heading home to Cambridge tonight for a brief but needed break from the world of this film.IMG_2934.JPG

Heretiks: Day 21

Heretiks: Day 20

A week to go. A party atmosphere is already developing. Rupert has decorated the magliners with tinsel and Xmas lights, and a box of Roses has appeared by the checks monitor.
Bex from Ren joins the crew for a couple of days as camera trainee. She covers for George in the never-ending battle to get a Teradek signal from one room to another.
I do a lot of walking up and down stairs while talking into a radio.
Rain messes with our plans. We shoot bits in the nun cell and surrounding corridors, and a scene in the chapel upstairs. This latter set we light for daylight for the first time. We have 15KW of lamps burning. Ben rigs a Joker Bug, a small 400W HMI, behind the false window, and we have larger HMIs coming in from the corridor and the loft above.
We shoot the nun cell redressed as a different room. It’s very hard to light a desk that is away from the window and the ceiling gobo. I shall ponder this problem before we shoot in there again.
IMG_2920.JPG

Heretiks: Day 20

Heretiks: Day 19

I feel like crap when I wake up, but by the time we start shooting I’m merely sniffly and a bit achey.
Last night I spotted on today’s call sheet that heavy rain was forecast and a day exterior was scheduled! After I pointed this out, the scene was bumped and so we’re shooting mostly in the nun cell and corridor today. After reviewing Javier’s edits with Ben, we decided that 650s on the ceiling simulating candlelight look best with a layer of tough-spun diffusion on, as per the chapel set, so this morning we diff the 650s in the corridor set too.
The nun cell has one small window and a gobo grill in the ceiling, so the lighting options are very limited. Though sometimes less is more. We do a night scene and, for the first time, I eliminate the 2.5K HMI punching in the window, going just with the 575W HMI coming in through the ceiling gobo (with opal diffusion and steel blue gel) and a kino in the window (with steel blue). We use bounce boards to bend the light onto the actors when these sources cannot reach them.
We bump up a candle in the room with a 300W tungsten fresnel. Ben fashions a black-wrap snood for it which makes its patch of light very controllable. Max fades it up and down in sync with the candle being lit and blown out.
Later, for a different scene, the 2.5K comes back into play. It works best when the beam misses our heroine. She’s just lit by the natural bounce and the diffusion caused by the impure ‘glass’ in the window. The shaft of light, combined with the textures of the set, give the image a beautiful painterly quality.
I regret that I cannot give a more convincing impression of nighttime in the cell. I would love there to be black outside the window, but any lamp powerful enough to put sufficient light into the set also makes the window itself turn white, as if there is a bright sky outside. If the window was modern, clean, fully transparent glass that would not happen, but this is a period film. I would also love to make the candlelight appear to be a much brighter source than the ‘moonlight’ coming in from the window. But there isn’t room. We can bump up the candlelight slightly in a mid or close-up, but in a wide there’s nowhere to hide anything.
One of the last shots of the day is a pick-up from a Tretower scene with an off-camera fire. The FX boys, Warwick and Aaron, bring in a fishtail – a small flame bar – along with a wind machine and smoke to replicate the exterior conditions indoors.

IMG_2918.JPG

Heretiks: Day 19

Heretiks: Day 18

We’re at the tree we reccied the other day, shooting a major stunt sequence. I noted on the reccie that the sun orientation was not ideal, but there was no real alternative. If it was overcast it wouldn’t matter, but we have blue skies for much of the day. The sun travels across the section of the sky we can’t shoot towards because of modern buildings in the background, so apart from the first hour or two of the day I’m forced to shoot with nasty frontlight. We use an 8’x8′ quarter silk to soften it a bit, but there’s not a lot else we can do. I got a nice lens flare shot early in the day, just before the sun went around into the no-go zone, so that keeps me happy for a while.
After lunch we shoot tight pick-ups for scenes we didn’t manage to finish at Tretower. The art department mock up a bit of set and we look at the Tretower footage on a laptop to match the lighting. It’s amazing what you can get away with on a 75 or 100mm lens.
I think I might be coming down with something. The shoot has reached the stage where the cumulative fatigue is a very real issue. I make a Lemsip when I get back to the cottage and hope I’ll feel better in the morning.

IMG_2912.JPG

Heretiks: Day 18

Heretiks: Day 17

Today we are filming in the ruins of an abbey in Margam Park. The weather is incredibly changeable, with bright sunshine and heavy showers alternating.
We block and shoot the action so that the camera and actors are under a covered part of the ruins, with a roofless part in the background. This is not just a practical consideration to keep us out of the rain, or to reduce the continuity issues with the changing cloud cover, though it certainly helps with both of those things. On an aesthetic level, it means that the natural light will mostly come from the background, illuminating the actors’ down-sides, while leaving their up-sides (the sides of their faces closest to camera) darker. This gives the most shape to the faces; it’s a key principle of cinematography and it applies just as much to day exteriors as it does to an artificially lit scene. I enhance the effect by having the boys bring in some 4×4 floppy flags to really cut down the light on the camera side. A silver bounce board is used to kick a little edge-light back onto Ania’s scar make-up in her close-up.
After a late lunch we shoot pick-ups for a night exterior scene, the one from the night at Tretower when we had horrendous weather. We set up on a little patch of grass right next to the castle doors, and the art department recreates a small part of the set.
When we wrap we go for crew drinks, our first proper social event of the shoot. I talk to one of the make-up artists and am shocked to hear how much longer their days are than ours. It is very easy not to realise how hard other departments are working. Often what you see, if you’re observing from another department, is only the tip of the iceberg.
IMG_2909.JPG

Heretiks: Day 17