Remote Data Services Data Control. Exploit or no?

[cd34]

I would think it would depend on the age of the freesite.

If it was submitted, and you went to review it, and it had that code on it, the window of opportunity for a hacker to have coincidentally corrupted a newly authored freesite would be pretty small. That's not to say we haven't seen hackers leave cron jobs behind that continued to modify files every 10 minutes, but, that is rather rare behavior.

If the freesite had been there for ages, and you stumbled across it, I would say that the likelihood is much greater for it to have been placed there by someone other than the original webmaster.

The thing that makes things like this easy to do on a large scale is foreign counters/iframes, etc. If someone distributes code that is pasted on a website, and that site is later compromised (either by hackers or integrity), everywhere that banner/advertisement/counter is, becomes a distributor.

Code can also be easily distributed through RSS feeds to blog networks. The kvantservice hack originally infected 12k sites, but, through the wonders of RSS and people pulling feeds blindly, at last count, 27k sites have repeated the affected posts.

Then you have linklists and webmasters that are embracing the CPI model and intentionally modifying their own sites to distribute malware and toolbars.

Difficult to say without knowing the reputation of the site author.

We have seen a number of FTP compromises recently with one common thread being the FTP user/password had been handed to a particular credit card billing company who stores their data in the clear in their admin. Odd as that company usually is only hacked every 18 months -- they only made 12 months this time.