Archive for the ‘Security Issues’ Category
Prevent Hotlinking of Your Picture Files
Written by Bec on October 30, 2009 – 1:30 PM -If you’re noticing a major increase in your bandwidth usage, you may have others hotlinking to your picture files, which is theft of your bandwidth and is called bandwidth leeching. A simple way to stop hotlinking is by adding this to your .htaccess file:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ – [F]
Replace mydomain.com with your actual domain name. With this code in place, your images will only display when the visitor is browsing http://mydomain.com. Images linked from other domains will appear as broken images.
If you’re feeling particularly nasty, you can even provide an alternative image to display on the hot linked pages — for example, an image that says “Stealing is Bad … visit http://mydomain.com to see the real picture that belongs here.” Use this code to accomplish that:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.mydomain.com/dontsteal.gif [R,L]
This time, replace mydomain.com with your domain name, and replace dontsteal.gif with the file name of the image you’ve created to discourage hot linking.
Be sure to upload your .htaccess in ASCII mode, and once it’s up there, chmod it to 644.
Tags: bandwidth leeching, prevent hotlinking
Posted in Articles & Tutorials, Security Issues | No Comments »
Prevent Affiliate Commission Theft Using Ninja Affiliate
Written by Bec on September 2, 2009 – 8:03 AM -
Affiliate Identity theft; affiliate link theft; affiliate commission theft; – whatever term you use, it means without link cloaking abilities, you, as an affiliate marketer, are being ripped off. You’re being robbed of your affiliate commissions.
Is affiliate commission theft a serious problem? I really don’t know with absolute certainty. Searching for an answer on the internet has coughed up conflicting information. However, the way I see it, whether you’re losing 5% or 40% of your commissions, a loss by any percentage is still a loss.
Can you prevent affiliate commission theft?
Yes, you can, but not by using any of the free scripts.
There are several methods available, some with free redirect scripts and with some using commercial software. While free methods may reduce the incidence of affiliate link theft or affiliate commission theft, they are unreliable and do not cloak your link, making bypass of your links really easy. To get full link cloaking you will need to spend some money. The bright side is that the very first affiliate commission theft you prevent will probably pay for the software a couple of times over.
I’m sure you’re aware that simply cloaking or hiding your links isn’t going to bring you ‘rivers of cash’ flowing into your ‘bank vault.’ Link cloaking may merely lessen the frequency of affiliate commission theft, and could reduce the amount of commissions you would have lost.
1. Some people recommend using free services by websites that shorten your link. I disagree totally with this method. These are actually for links to be included in emails, and are not for online website linking purposes. But, if you insist on trying them, use these services with extreme caution. They are just re-directing services, and store your information on their servers. If they go out of business, or remove your link for whatever reason, your links are kaput, gone, ground to dust. If you’ve used those links in article marketing, blogs or any other media that has been syndicated, you’ll have your links on perhaps thousands of sites all leading nowhere. What a colossal waste of your marketing efforts!
2. Use a re-directing script yourself and upload it to your own domain. This means you’ll need your own website and know how to use ftp, and know how to create a link. Your host server must also allow php. The re-directing script is simplicity itself.
However, note that while this shortens your link into something more attractive, and gives you full control over it, it does NOT cloak your link. When your visitor lands on the redirected site, your full affiliate link is visible, allowing your visitor to bypass your affiliate ID to deny you your commission. Why? I really don’t know either. But it happens. Some people simply don’t want anyone earning a commission from their purchase even though they pay the same price with or without using your link. Go figure.
You need to remember that you cannot cloak or re-direct links for every application. Some affiliate networks and Google Adwords do not allow re-directing or cloaking. Carefully study the terms and conditions of affiliate publishers before signing up with them or you could be expending a lot of effort for nothing.
3. You can also choose to buy your own cloaking software which gives you more options and complete control not only over link cloaking but commission theft from parasite software as well. This is the recommended method for serious affiliate marketers – those who actually plan on earning real income from affiliate marketing.
Effective cloaking software not only hides your affiliate links but also protects you from parasite software. Simple redirects do not offer this protection.
Parasite Software [which apparently is covertly installed on 80% of PCs,] activates after your visitor has landed on the merchant’s web site. Since the parasite software strikes only after the visitor has arrived at the merchant’s site, redirects are totally ineffective as a protective measure.
It is well worth the cost and effort to keep your affiliate commissions out of other people’s pockets and put it in your own. After all, you’re the one who spent so much time marketing the product.
To protect your affiliate commissions against link hijackers, link bypassers and parasite software with a comprehensive affiliate link cloaking system, I suggest you check the advanced features and complete cloaking function of Ninja Affiliate, a Wordpress plugin that will hand you full control and management of all of your affiliate marketing links.
Besides link cloaking you’ll find that Ninja Affiliate provides you with a terrific combination of link management tools:
- Easy Affiliate Link Management – You can easily give each affiliate link an easy-to-remember name.
- Flexible Link Management - Accepts every affiliate link format out there, so you don’t have to waste time with various affiliate marketing tools.
- Create Professional Redirect Links – Use professional looking redirect links that let your prospects know you’re a pro marketer.
- Manage Links by Groups – Too many affiliate links? Ninja Affiliate allows you to easily create different groups to manage your links..
- Prevent “Affiliate Theft” – Cloak your affiliate links to prevent link theft and affiliate sabotage. No one will ever steal your hard-earned commissions again..
- Insert Affiliate Links Directly – Add your affiliate links directly for your Wordpress blog editor – you’ll never have to hunt for links again.
- Transform Keywords to Links – Automatically turn keywords in your blog to affiliate links. You can set a limit too, so your posts don’t look like a spam blog!
- Advanced Display Options – Ninja Affiliate allows you to display any text you want in your web browser’s status bar.
- Use “No-Follow” Links – Control your link juice and escape punishment from Big Daddy Google with ninja precision. In fact, you can control your links any way you want to.
Co-Author: Ashutosh
Tags: affiliate commission theft, affiliate link theft, link cloaking, ninja affiliate plugin, wordpress plugin
Posted in Blog Plugins & Widgets, Blog Services, Security Issues | No Comments »
A Word to the Wise: Back It Up!
Written by Bec on January 4, 2009 – 4:30 PM -Fast on the heels of the Thumblogger server hack comes this news from GayBucks Chip about another big mainstream blogging host service with server failure:
“Just read about Journalspace on Slashdot and thought it might be a word to the wise for folks here. Journalspace.com, a free blogging site, had some 14,000 bloggers. Last week, they had a drive failure in their database server. They were using RAID 1 (drive mirroring) as their sole means of backup, meaning they had their server set so that anything written to one drive was mirrored to another; this theoretically allows you, in the event of a drive crash, to simply replace the bad drive and everything’s fine because the data is mirrored.
Many ISPs do this and some tell their customers that it eliminates the need for individual backups.
Unfortunately, Journalspace just discovered that the problem wasn’t that the drives failed, but that the data was overwritten and is completely unrecoverable. Someone or some thing caused all the data to be overwritten, and of course, since the drives were mirrored, the backup (mirror) was overwritten as well.
In other words, their entire business, and some 6 years worth of some 14,000 bloggers entries, are gone. They are simply giving up and closing down.
This should serve as a sobering reminder to double, triple, and quadruple check on your backup arrangements.
I recommend that people not trust their ISPs and make a copy of their own backups, at least several times a year, of all their sites, MySQL databases, HTML, etc. No matter whom your ISP is, I think it’s a wise move to keep copies of your sites, MySQL databases, etc somewhere other than in your ISP’s data center… download it to your local computer, copy it across to a server in somebody else’s data center, whatever it takes.
If you rely on an IT guru (as Journalspace did) to handle your backup arrangements, I also recommend that you ask somebody else to check it out, see what’s going on, and make sure that you have a bulletproof solution.
I also believe (even though NatNet tells me it’s “old school” and obsolete) in keeping archival tape backups, since tapes of the right type (SDLT or LTO) are considered more stable and reliable than hard drives, and are the storage medium that the Library of Congress uses to archive crucial media.
The owner of Journalspace realizes that it’s his own fault for not double-checking his IT guy’s decisions, so I’m posting this in hopes that people might take steps to ensure that their backup procedures are secure to prevent something like this from happening.”
That’s excellent advice Chip, here’s hoping others double check what is in place for their server backup system and actually take steps to prevent this from happening to them.
Followup: This is posted on Journalspace:
We have six months to go on our hosting contract, so we’re selling the journalspace.com and journalspace.net domains to cover our costs until our contract runs out. 15% of the sale price will be donated to the Susan G. Komen For The Cure charity.
Tags: backup hard drive, backup your server, Journalspace drive failure
Posted in Articles & Tutorials, From the Forums, Industry News, Security Issues | No Comments »
Wordpress Users Be Aware of Fake WP Downloads
Written by Bec on December 1, 2008 – 8:00 AM -
As most of you probably already know, the release of Wordpress 2.7 has been delayed. There is a 2.6.5 version available that addresses some security issues. And please take care when searching for WordPress downloads so that you do not end up on a fake WordPress site. Wordpresz.org looks like the WordPress site but isn’t.
This is just the first of what could be a run on fake sites that take advantage of your misspellings and spoofs the official WordPress site. Pay close attention to what site URL you are actually on after clicking any links, or type out manually http://www.wordpress.org/ and double check the URL before downloading anything from the official WordPress sites.
If you upgraded WordPress to 2.6.4, you are running a fake version. There is no WordPress 2.6.4. The latest version is 2.6.5. The version of WordPress you download has malicious code in the download that opens a backdoor to your blog.
Automattic is looking at ways to keep users informed and warned about these blog hack attempts, but paying attention to details is your best defense. Just check first and know what you are downloading, and from where, before risking your blog.
Tags: blog hack, fake downloads, Wordpress, wp
Posted in Security Issues, Wordpress | No Comments »
Wordpress Releases 2.3.3
Written by Bec on February 7, 2008 – 1:01 PM -![]()
There is an update to Wordpress: Version 2.3.3 that was released 3 days ago. It addresses a security flaw and a few bug issues from the 2.3.2 release. You can download the newest version of Wordpress here.
Posted in Security Issues, Wordpress | No Comments »
Computer Security Tip
Written by Bec on January 19, 2008 – 5:00 AM -Here’s a terrific little computer security tip to prevent remote connections to your computer that all of us can benefit from, written by Diana Higgins, a writer for LockerGnome. Â
Prevent Remote Connections to Your Computer.
If you don’t use it, or only use it on occassion, disable Remote Desktop on your computer by right clicking your desktop screen, and select Properties. Now select the Remote tab and uncheck the box where it says allow users to connect remotely option. Once you click OK users will not be able to connect to your computer.
Tags: prevent remote computer connections
Posted in Articles & Tutorials, Security Issues | No Comments »
How To Secure Your NATS Data
Written by Bec on January 17, 2008 – 7:23 AM -This article from TheDocBlog is even more detailed than the information provided directly from NATS on how to secure your NATS database.
This Guide covers securing your NATS backend and performing an overall audit of your NATS backend security setup. Many tips found throughout this guide can be used to secure other Webmaster Programs and scripts like Wordpress too.
As with any Program Backend, Security should be your Number One priority. The email hungry and password-trading world is a relentless underground network that will never back off. (plus all the other bs they could get) These guys continually hunt all Webmaster Programs, there servers, networks, bad scripts, and anything else they can find to use as a backdoor in so they can start pawning the Program again.
You don’t have to be a Server Admin or a NATS God to use this guide. However, some parts of this article do require Server Administration Skills and an advanced understanding of Webmastering Nats.
Most Hosting Companies can easily assist you adding the more advanced security additions, if needed. If you are one of those unlucky few that got stuck with a crap host or if you are just in need of a solid Hosting Company then I recommend you check out Phatservers and oc3 Networks for some reliable and secure hosting services.
Anyway, Please don’t try to secure your own NATS Program and Server if you don’t fully understanding what you are doing. Security setup mistakes can be the cause for some nasty problems.
Tags: NATS database, NATS security
Posted in Articles & Tutorials, NATS, Security Issues | No Comments »
Urgent Security Upgrade to Wordpress
Written by Bec on January 2, 2008 – 4:13 PM -If you haven’t logged into your admin panel on a wordpress install yet due to heavy holiday celebrating, there’s a critical security upgrade awaiting your immediate attention.
WordPress 2.3.2 is an urgent security release that fixes a bug that can be used to expose your draft posts. 2.3.2 also suppresses some error messages that can give away information about your database table structure and limits and stops some information leaks in the XML-RPC and APP implementations.
Posted in Articles & Tutorials, Security Issues, Wordpress | No Comments »


























