Jalaj P. Jha Technical & Miscellaneous Ramblings

HTTP Headers can help you find jobs :)

My blog is hosted on wordpress.com… well neither my blog nor hosting is the topic for this post, but wordpress.com is… I was going through low level http calls and got to see the http headers of my blog, which mostly looked like a typical header with a difference… it contained a line that said "X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header. "

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 28 Jan 2009 23:57:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Cookie
X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
X-Pingback: http://jalaj.net/xmlrpc.php

As I said my blog is hosted on wordpress.com, all other blogs that are on wordpress.com too show the similar line. The line seems amusing but more strange is the history behind it, which I got to learn on searching Google for the above line. A post more than a year old discloses that it is actually marks closure of a backdoor, one that allowed the developers of “Wordpress mu”, which powers wordpress.com and many other sites, to get the statistics on the number of individual blogs existing on that platform.  For example let’s check the http headers for a Wordpress mu (mu stands for multiuser) installation at an educational institute at http://clove.edschool.virginia.edu/wordpressmu/

HTTP/1.0 200 OK
Date: Thu, 29 Jan 2009 00:22:01 GMT
Server: Apache/2.2.9 (Fedora)
X-Powered-By: PHP/5.2.6
X-totalblogs: 5
X-rootblog: http://clove.edschool.virginia.edu/wordpressmu/
X-created-on: 2007-09-12 09:19:40
X-Pingback: http://clove.edschool.virginia.edu/wordpressmu/xmlrpc.php
Content-Length: 4905
Connection: close
Content-Type: text/html; charset=UTF-8

So you now know that 5 blogs exist there! Do the backdoor still exists? Not any more, at least this particular one, which can now only be seen on sites who have not updated their installation for long time.

Any of you know where the backdoor is now shifted to? Eager to hear!