Elliott C. Back: In Aere Aedificare

I’ve been getting a lot of Wordpress comment / trackback spam pointing to Squidoo these days, because it doesn’t valid the HTML markup users can enter into their pages. This makes it easy for spammers to put in an iframe with an external src that basically redirects the browser to their spam (usually porn) page. If the javascript were nice it would look like this:

window.onload=function(){
    window.location = "http://wpi.biz/in.cgi?5&parameter=porn";
}

The page you get redirected looks like a bunch of adult-themed Youtube vidoes–they’re just images, actually, which I’ve censored–that prompt you to download something that’s probably spyware. I didn’t really investigate this further, it’s obviously very evil:

The code actually sitting on Squidoo’s servers looks like this:

And the comments left on my blogs are of the form:

New trackback on your post #1852 "Coding Horror:  Hot Tech Blog"
Website: hot ebony men (IP: 190.72.74.193 , <a href="http://190-72-74-193.dyn.dsl.cantv.net" title="http://190-72-74-193.dyn.dsl.cantv.net" target="_blank">190-72-74-193.dyn.dsl.cantv.net</a>)
URI    : <a href="http://www.squidoo.com/some-nasty-url/" title="http://www.squidoo.com/some-nasty-url/" target="_blank">www.squidoo.com/some-nasty-url/</a>
Excerpt: hot ebony men…

I’ve sent email to both the Akismet team and the Squidoo team about this, hopefully they will:

1. Implement kses-based filtering on their html input *immediately*
2. Add some spam-weight to the squidoo domain until this is fixed

There’s no excuse for an XSS attack of this simplicity to exist. Javascript, iframes, etc should be disallowed. Just let basic markup through, and strip out the rest! For now, I also recommend adding the word “squidoo” to your blacklist in the Wordpress discussion options.

Update: According to the Squidoo blog, iframes will banned as of July 12th. I can’t think of anything you can do with an iframe that you can’t do with regular HTML except untrusted stuff, like redirects or arbitrary JS.

There’s a new monetization service from AdBrite which is quite promising. It’s called BritePic and offers to overlay assorted controls on top of your images, as well as unobtrusive advertisements. Their list of features is long, but rather unimpressive:

# Email this image
# Link to this image
# Embed this image (you still get the ad revenue, even if your pic is embedded elsewhere)
# Zoom in and out (see demo)
# Captions that slide out when you hover over the pic
# Ads from AdBrite
# Link the image to another URL
# Subscribe to RSS

What really shines is the user interface for their BritePic enhancements. It’s a sheer, transparent overlay that reacts to mouse events and hides when not active. For example, it adds a header which you can mouseover to show the advertisement:

There’s also a menu added to the bottom to produce a list of features:

I’m definitely going to start running the ads on this blog, just because I like how easy they are to use, and how little they get in the way of the user experience. I coded up a quick Wordpress plugin to replace all image tags with appropriate adbrite tags, and it works fine for me so far: adbrite-images.rar. You need to replace the Adbrite ID with your own, and then activate and you’re good to go.