I saw the other day that AndyHagans.com had been hacked, and thought nothing of it, until this morning. I went to show a picture of my daughter to a co-worker from my personal blog, when I noticed the following in the footer…

Of course, none of these were links that I’d placed on the blog. So I went into the template, and discovered a script tag that I hadn’t placed on the blog. Removing it removed the nefarious links.

So how did they do it? If they managed to guess my password, why did they only alter that one blog (I have multiple blogs on that account)? There’s no ftp for this blog, as it’s hosted on blogspot, so there’s no opportunity to hack it that way (as happened to Andy Hagan). Ah well, a change of passwords is in order, and I’ll see if that stops it from happening again.