Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress 5.2: Mitigating Supply-Chain Attacks

paragonie.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#31

Post by CiPHPerCoder »

eitland wrote: post #28

> In the future, we will be working to implement a system that allows vendors to sign their own releases and publish these signatures (and related metadata) to an append-only cryptographic ledger. Without dismissing all crypto currencies this seems more immediately practically useful:-)

If you're curious:

https://paragonie.com/blog/2016/10/guide-automatic-security-...

https://paragonie.com/blog/2017/07/chronicle-will-make-you-q...

I've written a lot about the design and utility of append-only cryptographic ledgers for this use case.

Mozilla has their own implementation based on Certificate Transparency: https://wiki.mozilla.org/Security/Binary_Transparency

Filippo Valsorda is working on bringing something similar to the Go ecosystem, based on a Trillian personality.

There's a lot of work going on, there's just not a marketing team behind these efforts, so you only ever hear about blockchains and ICOs.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#32

Post by kiesel »

CiPHPerCoder wrote: post #30
kiesel wrote: post #20

The update mechanism itself is still insecure, as the wordpress instance must have the ability to exchange its own source code - something you'd at least call risky. Web applications should run with the least possible privileges, ie. only with permissions to write to dedicated locations on the filesystem (user uploads), and read permissions for the code. PHP has composer, a dependency management system. There's an op…

> Web applications should run with the least possible privileges, ie. only with permissions to write to dedicated locations on the filesystem (user uploads), and read permissions for the code. This isn't wrong but I'd argue it's a lower priority concern than you believe it is. A comprehensively secure automatic update system would have process isolation between the normal web interface and the updater (and the latter…

> A comprehensively secure automatic update system would have process isolation between the normal web interface and the updater (and the latter would run as a different, more privileged user). However, not everyone can do that. (Shared hosting, etc.)

That's right, and I also think the popularity stems from the simplicity and the fact that it existed when the whole blog thing took off.

There's actually the option to provide your FTP credentials in the admin console and have wordpress update itself over an FTP connection. It is process separation, then, but OTOH potentially exposes your webspace credentials to an attacker. :-)

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#33

Post by zelon88 »

kiesel wrote: post #20

The update mechanism itself is still insecure, as the wordpress instance must have the ability to exchange its own source code - something you'd at least call risky. Web applications should run with the least possible privileges, ie. only with permissions to write to dedicated locations on the filesystem (user uploads), and read permissions for the code. PHP has composer, a dependency management system. There's an op…

Can you elaborate on the specific threats you're thinking of?

I'm picturing a WordPress environment where all the source code owned by root with R+X permissions for www-data and nobody else, and an "Uploads" directory owned by root that has R+W for www-data with no X.

So assuming we have locked down permissions but still running a vulnerable plugin; we still have code execution and can ex-filtrate secrets via Uploads or create symlinks or upload malicious payloads. We just can't use the webserver to change code. You could still steal credentials that give us access via other means.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#34

Post by rograndom »

frereubu wrote: post #19
someexgamedev wrote: post #5

I set up a WordPress site for a family member a couple years ago and threw wordfence on there just to see what the ecosystem is like. I get near daily alerts of attempted hacks mostly from Eastern Europe. Most common thing is trying to brute force the login page. Any improvements to WordPress security are welcome. It's got such a huge target painted on its back. Reminds me of windows in the 90s. As for what I learned…

This plugin allows you to rename the login page - https://wordpress.org/plugins/rename-wp-login/ . It says untested with the last three versions of WordPress, but we use it on all our sites and have had no issues. It also doesn't redirect non-logged-in requests for /wp-admin/ to the login URL like the standard setup, so it doesn't make the new login URL available in any way. We were experiencing server slowdowns beca…

Do not use that plugin. It has a unintentional back door where you can just bypass it completely and get the login screen. All of the forked plugins that are based on it, that I have seen, have the same issue.

Plus, since it's more than 3 versions old, many of the security plugins will flag it. If it's your site, that's fine. If you have set a site up for someone else, it's hard to explain that it's ok to use this plugin.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#35

Post by frereubu »

rograndom wrote: post #34
frereubu wrote: post #19

Earlier quoted context omitted.

This plugin allows you to rename the login page - https://wordpress.org/plugins/rename-wp-login/ . It says untested with the last three versions of WordPress, but we use it on all our sites and have had no issues. It also doesn't redirect non-logged-in requests for /wp-admin/ to the login URL like the standard setup, so it doesn't make the new login URL available in any way. We were experiencing server slowdowns beca…

Do not use that plugin. It has a unintentional back door where you can just bypass it completely and get the login screen. All of the forked plugins that are based on it, that I have seen, have the same issue. Plus, since it's more than 3 versions old, many of the security plugins will flag it. If it's your site, that's fine. If you have set a site up for someone else, it's hard to explain that it's ok to use this pl…

Can you give me more detail than "unintentional back door"? I'm obviously interested, but it's difficult to know what to do without more of a pointer on what the issue is.

Edit: Found this - https://github.com/ellatrix/rename-wp-login/issues/27 - and can reproduce that behaviour, so I'm going to start looking for something new, or potentially taking over that plugin.

Edit 2: This seems to be a maintained fork that is in active development and covers the issues on the original abandoned GitHub repo - https://wordpress.org/plugins/wps-hide-login/

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#36

Post by frereubu »

mr__y wrote: post #26
frereubu wrote: post #19

Earlier quoted context omitted.

This plugin allows you to rename the login page - https://wordpress.org/plugins/rename-wp-login/ . It says untested with the last three versions of WordPress, but we use it on all our sites and have had no issues. It also doesn't redirect non-logged-in requests for /wp-admin/ to the login URL like the standard setup, so it doesn't make the new login URL available in any way. We were experiencing server slowdowns beca…

Could you recommend some real[0] WP-focused providers? Since the company I work for has several WP websites with relatively high traffic we've been looking for such providers, tested some but ended with having some VPSes to have the ability to set them up properly. Since those servers are self-managed this is obviously a sub-optimal solution as we have to maintain them, so a reliable hosting provider would be great.…

We've been using a VPS-1 on Pagely for a few years now, and are generally very happy with the service. They take away the management of Ubuntu and security hardening etc, but give you control where you need it such as SSH access - I've written a few bash scripts that use WP-CLI to make it easier to manage multiple sites. We've had one or two small issues, but all fixed quickly, and nothing of the sort that made us start looking elsewhere. You sometimes have to be persistent with first-line support, but things generally get escalated appropriately if necessary.

The one real gripe I have is that they rewrote their control panel as an SPA, and I think it's made it much less usable. It's difficult to do things like open a link in a new window, and state doesn't always remain or update in the right way - for example, you can lengthen and sort a list, go to an item, use the back button and you have to lengthen and sort the list again. However, I don't use that control panel enough to make it a serious time drag, and they're apparently writing an API which should cover most of my use cases.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#37

Post by kiesel »

zelon88 wrote: post #33
kiesel wrote: post #20

The update mechanism itself is still insecure, as the wordpress instance must have the ability to exchange its own source code - something you'd at least call risky. Web applications should run with the least possible privileges, ie. only with permissions to write to dedicated locations on the filesystem (user uploads), and read permissions for the code. PHP has composer, a dependency management system. There's an op…

Can you elaborate on the specific threats you're thinking of? I'm picturing a WordPress environment where all the source code owned by root with R+X permissions for www-data and nobody else, and an "Uploads" directory owned by root that has R+W for www-data with no X. So assuming we have locked down permissions but still running a vulnerable plugin; we still have code execution and can ex-filtrate secrets via Uploads…

By being able to modify executable files on the webserver, an attacker can add a backdoor through a security hole quite easily. Without, he could just make use of the security hole as of itself.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#38

Post by xenospn »

onion2k wrote: post #17
xenospn wrote: post #8

Earlier quoted context omitted.

I highly recommend wordfence. I have it set to immediately block anyone after a single failed login attempt.

So if I know the username of someone who admins your website I could shut them out with a single POST request? Seems a bit risky.

It's a small site. Not a concern.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#39

Post by apple4ever »

someexgamedev wrote: post #5

I set up a WordPress site for a family member a couple years ago and threw wordfence on there just to see what the ecosystem is like. I get near daily alerts of attempted hacks mostly from Eastern Europe. Most common thing is trying to brute force the login page. Any improvements to WordPress security are welcome. It's got such a huge target painted on its back. Reminds me of windows in the 90s. As for what I learned…

I really like WP-Cerber: https://wordpress.org/plugins/wp-cerber/
Post reply on HN