linkback
A linkback is a method for Web authors to obtain notifications when other authors link to one of their documents. This enables authors to keep track of who is linking to, or referring to, their articles. The four methods ( refback, trackback, p ...
methods for Web authors to request notification when somebody links to one of their documents. This enables authors to keep track of who is linking to, or referring to their articles. Some
weblog
A blog (a truncation of "weblog") is a discussion or informational website published on the World Wide Web consisting of discrete, often informal diary-style text entries (posts). Posts are typically displayed in reverse chronological order ...
software and
content management systems
A content management system (CMS) is computer software used to manage the creation and modification of digital content (content management).''Managing Enterprise Content: A Unified Content Strategy''. Ann Rockley, Pamela Kostur, Steve Manning. New ...
Movable Type
Movable type (US English; moveable type in British English) is the system and technology of printing and typography that uses movable components to reproduce the elements of a document (usually individual alphanumeric characters or punctuation m ...
ping
Ping may refer to:
Arts and entertainment Fictional characters
* Ping, a domesticated Chinese duck in the illustrated book '' The Story about Ping'', first published in 1933
* Ping, a minor character in ''Seinfeld'', an NBC sitcom
* Ping, a c ...
ed when the article is published. Other content management systems, such as Drupal and Joomla, support pingbacks through the use of addons or extensions.
Essentially, a pingback is an XML-RPC request (not to be confused with an ICMP
ping
Ping may refer to:
Arts and entertainment Fictional characters
* Ping, a domesticated Chinese duck in the illustrated book '' The Story about Ping'', first published in 1933
* Ping, a minor character in ''Seinfeld'', an NBC sitcom
* Ping, a c ...
) sent from Site A to Site B, when an author of the blog at Site A writes a post that links to Site B. The request includes the URI of the linking page. When Site B receives the notification signal, it automatically goes back to Site A checking for the existence of a live incoming link. If that link exists, the pingback is recorded successfully. This makes pingbacks less prone to spam than trackbacks. Pingback-enabled resources must either use an X-Pingback header or contain a element to the XML-RPC script.
In March 2014, Akamai published a report about a widely seen exploit involving pingback that targets vulnerable WordPress sites. This exploit led to massive abuse of legitimate blogs and websites and turned them into unwilling participants in a DDoS attack. Details about this vulnerability have been publicized since 2012, with Akismet reporting in 2013 that "almost 100% of trackbacks and pingbacks are spam".
The pingback attacks consist of "reflection" and "amplification": an attacker sends a pingback to a legitimate Blog A, but providing information of the legitimate Blog B ( impersonation). Then, Blog A needs to check Blog B for the existence of the informed link, as it's how the pingback protocol works, and thus it downloads the page off Blog B server's, causing a ''reflection''. If the target page is big, this ''amplifies'' the attack, because a small request sent to Blog A causes it to make a big request to Blog B. This can lead to 10x, 20x, and even bigger amplifications (
DoS
DOS is shorthand for the MS-DOS and IBM PC DOS family of operating systems.
DOS may also refer to:
Computing
* Data over signalling (DoS), multiplexing data onto a signalling channel
* Denial-of-service attack (DoS), an attack on a communicat ...
). It's even possible to use multiple reflectors, to prevent exhausting each of them, and use the combined amplification power of each to exhaust the target Blog B, being by overloading bandwidth or the server CPU ( DDoS).
WordPress changed a bit how the pingback feature works to mitigate this kind of vulnerability: the IP address that originated the pingback (the attacker address) started being recorded, and thus shown in the log. Notwithstanding, in 2016, pingback attacks continued to exist, supposedly because the website owners don't check the user agent logs, that have the real IP addresses. It has to be noted that, if the attacker is more than a script kiddie, he will know how to prevent his IP address being recorded, by, for example, sending the request from another machine/site, so that this machine/site IP address is recorded instead, and the IP logging then, becomes less worthy. Thus, it's still recommended to disable the pingbacks, to prevent attacking other sites (although this does not prevent being target of attacks).
See also
* Weblogs.com, an earlier XML-RPC interface for weblogs to send pingbacks.
*
Webmention
Webmention is a W3C recommendation that describes a simple protocol to notify any URL when a website links to it, and for web pages to request notifications when somebody links to them. Webmention was originally developed in the IndieWebCamp co ...
, a modern re-implementation of Pingback using HTTP and x-www-urlencoded POST data.
*
Linkback
A linkback is a method for Web authors to obtain notifications when other authors link to one of their documents. This enables authors to keep track of who is linking to, or referring to, their articles. The four methods ( refback, trackback, p ...
, the suite of protocols that allows websites to manually and automatically link to one another.
*
Refback A refback is one of four types of linkbacks, methods for Web authors to request notification when somebody links to one of their documents. This enables authors to keep track of who is linking to, or referring to their articles.
A Refback is simp ...
, a similar protocol but easier than pingbacks since the site originating the link doesn't have to be capable of sending a pingback.
* Trackback, a similar protocol but more prone to spam.
* Search engine optimization