Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress sites under attack from newly found Linux trojan

darkreading.com

Post reply on HN
Print view View original

41–50 of 83 posts

Re: WordPress sites under attack from newly found Linux trojan

#41

Post by pwdisswordfish9 »

jeroenhd wrote: post #26
sourcecodeplz wrote: post #20

Wordpress is great for rapid prototyping but as history has shown, relying on third parties for additional functionalities in production environments, comes with great risks. Most usage of Wordpress today are definably not blogs, but full blown websites with many functionalities not found on a blogging software.

I wasn't surprised to read that once again the plugins were the cause of the security issues. I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code, but WordPress itself has had very few vulnerabilities over the years. Even still, the vulnerabilities this plugin exploits have CVE numbers starting with 2016 and 2019. I'd say that you can use WordPress for websites perfec…

> I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code

1. Random person who doesn't know anything about computers has stumbled their way into having a wordpress site

2. This person wants their site to do something special

3. This person can't find it online

4. This person decides not to give up and cobbles something together using random decade old examples from online

5. This person decides to share their work on the wordpress plugin store

6. Many wordpress sites get hacked

Re: WordPress sites under attack from newly found Linux trojan

#42

Post by mgkimsal »

thaumaturgy wrote: post #39
jeroenhd wrote: post #26

Earlier quoted context omitted.

I wasn't surprised to read that once again the plugins were the cause of the security issues. I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code, but WordPress itself has had very few vulnerabilities over the years. Even still, the vulnerabilities this plugin exploits have CVE numbers starting with 2016 and 2019. I'd say that you can use WordPress for websites perfec…

There are a number of challenges that, together, are specific to the WordPress platform: - WordPress's documentation for plugin development is not great, especially for new plugin developers. Somebody recently posted a link on HN to a small WP plugin they had developed, and it took only a few minutes to spot several things that were a bit wrong with their plugin. It wasn't their fault; the only way to know these thin…

> So, most WP sites end up looking like an accreting disk of plugins. I've seen sites with nearly a hundred plugins installed.

I took over a site - woocommerce install - with ... 68 plugins. When I've mentioned that over the years it's almost always met with "no, that's not right - no one does that - you don't know what you're talking about - they did it wrong"... etc.

Thanks for reiterating this. When 'redir ssl' and 'log visitor' and 'Fedex' and 'ups' and 'usps' and 'shrink image' functionality are all externalized to different vendors, the 'modularity' of a system requires trusting dozens of disparate development processes, greatly increasing the potential for security problems.

Re: WordPress sites under attack from newly found Linux trojan

#43

Post by pauljonas »

thaumaturgy wrote: post #39
jeroenhd wrote: post #26

Earlier quoted context omitted.

I wasn't surprised to read that once again the plugins were the cause of the security issues. I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code, but WordPress itself has had very few vulnerabilities over the years. Even still, the vulnerabilities this plugin exploits have CVE numbers starting with 2016 and 2019. I'd say that you can use WordPress for websites perfec…

There are a number of challenges that, together, are specific to the WordPress platform: - WordPress's documentation for plugin development is not great, especially for new plugin developers. Somebody recently posted a link on HN to a small WP plugin they had developed, and it took only a few minutes to spot several things that were a bit wrong with their plugin. It wasn't their fault; the only way to know these thin…

Absolutely, the WP ecosystem cultivates this mindset.

The reliance on plugins to do a lot of heavy lifting (admittedly, a lot of these stray far from the original blog engine WP provides) but that is because WP is used as more than a blog now, more than a CMS, it's like a core with a myriad of swiss army knife appendages.

Re: WordPress sites under attack from newly found Linux trojan

#44

Post by dec0dedab0de »

sschueller wrote: post #10

I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming lan…

I don't think linux has anything to do with it.

I took that to mean it runs on Linux.

Re: WordPress sites under attack from newly found Linux trojan

#46

Post by BirAdam »

sschueller wrote: post #10

I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming lan…

Yeah, typically, a web server should be setup such that the web servers process runs as say: www-data:www-data, and then the web files should be: joe:www-data and those web files should be 644. In this manner, the web server process can read the files, but the files can neither be written to nor run. This very basic stuff that most of the world seems to ignore completely.

Re: WordPress sites under attack from newly found Linux trojan

#47

Post by BirAdam »

fortran77 wrote: post #29

Why does all this open source stuff have so many problems? Aren’t there a lot of eyes looking at the code?

This is a valid question, but the answer is somewhat simple. The open source code is both widely used and easily studied. Because of this, it gets targeted. As it can be studied, the vulnerabilities are both known and talked about. In the case of proprietary software, the owners are neither going to be quick to admit a problem exists, nor quick to allow study of their system(s) to discover the cause (in most cases, exceptions to this obviously exist).

Security vulnerabilities are everywhere, but only in widely-used open source code is the discovery of a vulnerability likely to be both known and discussed.

Re: WordPress sites under attack from newly found Linux trojan

#48

Post by LinuxBender »

mdrzn wrote: post #5

Website loads as a white page to me. Even the Google-cached version.

I think they added some detection to block archiving tools and as such some addons will break the site, or perhaps better wording on my part would be that the site will break some clients.

Re: WordPress sites under attack from newly found Linux trojan

#49

Post by BirAdam »

habibur wrote: post #2

answers, "why you should write your own framework, if you have the knowledge and time."

Well, I would argue that one should write a web framework if he/she wants to do so. There is no other reason really.

Running anything on the web has risks, some more than others. Likewise, there are tradeoffs to any given plan.

Wordpress itself isn't some terrible thing, but an outdated version with 100+ plugins that is poorly administered is likely to be an unauthenticated root shell that happens to also function as a website. This is true of any web framework though.

Re: WordPress sites under attack from newly found Linux trojan

#50

Post by denton-scratch »

hdjjhhvvhga wrote: post #30
mdrzn wrote: post #5

Website loads as a white page to me. Even the Google-cached version.

Maybe because of this: > window.loadedOnetrust = true;if (window?.activeAdsLoad {window.activeAdsLoad?.checkAdsBlock();window.activeAdsLoad?.activeAds()} Who cares, I just close the window and don't give it another thought - the site just eliminated itself from the usable part of the Internet.

Yup. I don't know what kind of mentality wants to punish users for rejecting ads. I guess you have to take the view that the ads are more important than the content.

But what does that say about the content? To me, it says that the content is worth even less than the ads I'm already deliberately blocking.

Many companies seem to put the company website under the control of marketing. That's OK, until the marketing department goes megalomaniac, and decides that all company operations amount to marketing. So much for the website.

Post reply on HN