Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

31–40 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#31

Post by herf »

saltyoldman wrote: post #3

I see a future where there are LLM vetted repos for Java, Python, Go, etc... And it will cost $1 to submit a release candidate (even for open source) edit: The idea is the $1 goes towards the tokens required to scan the source code by an LLM, not simply cost a dollar for no other reason that raising the bar. First submission is full code scan, incremental releases the scanner focuses on the diffs.

This is an ideal place for LLMs to run (is this changelist a security change or otherwise suspicious?) but I don't think the tokens will be so expensive. For big platforms, transit costs more money - the top packages are something like 100M pulls per week.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#32

Post by chromacity »

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec.

We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specific development for making things dramatically worse, it's cryptocurrencies, not AI. They've turned the cottage industry of malicious hacking into a multi-billion-dollar enterprise that's attractive even to rogue nations such as North Korea. And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake".

We know how to write software with very few bugs (although we often choose not to). We have no good plan for keeping big enterprises secure in this reality. Autonomous LLM agents will be used by ransomware gangs and similar operations, but they don't need FreeBSD exploit-writing capabilities for that.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#33

Post by dijksterhuis »

bayindirh wrote: post #23
iugtmkbdfil834 wrote: post #17

Earlier quoted context omitted.

There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.

That won't happen, because time to market is the biggest obstacle between the developers and the monies. If leftpad, electron, Anthropic, Zed, $shady_library$ gonna help developers beat that obstacle, they'll do it instantly, without thinking, without regret. Because an app is not built to help you. It's built to make them monies. It's not about the user, never. Note: I'm completely on the same page with you, with a…

i guess it's a market thing? because when i build stuff in a B2B scenario for customers, it is about the customer's users. Because the customer's users are the money.

at least, that's my attitude on it :shrugs:

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#34

Post by dec0dedab0de »

bluGill wrote: post #15
dec0dedab0de wrote: post #9

Earlier quoted context omitted.

The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks. This is the best reason for letting users install from npm directly instead of bundling dependencies with the project.

What user is going to check dependencies like that?

I was really saying that if there is a compromised version that gets removed from NPM, then the projects using it do not need to be updated, unless of course they had the compromised version pinned.

Though plenty of orgs centralize dependencies with something like artifactory, and run scans.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#35

Post by bayindirh »

dijksterhuis wrote: post #33
bayindirh wrote: post #23

Earlier quoted context omitted.

That won't happen, because time to market is the biggest obstacle between the developers and the monies. If leftpad, electron, Anthropic, Zed, $shady_library$ gonna help developers beat that obstacle, they'll do it instantly, without thinking, without regret. Because an app is not built to help you. It's built to make them monies. It's not about the user, never. Note: I'm completely on the same page with you, with a…

i guess it's a market thing? because when i build stuff in a B2B scenario for customers, it is about the customer's users. Because the customer's users are the money. at least, that's my attitude on it :shrugs:

> Because the customer's users are the money.

That's exactly what I'm talking about. The end desire is money, not something else. Not users' comfort, for example. That B2B platform is present because everyone wants money.

Most tools (if not all) charge for services not merely for costs and R&D, but also for profit. Profit rules everything. Users' gained utility (or with the hip term "value") is provided just for money.

Yes, we need money to survive, but the aim is not to survive or earn a "living wage". The target is to earn money to be able to earn more monies. Trying to own all.

This is why enshittification is a thing.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#36

Post by Shank »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake".

LAPSUS$ was prolific by just bribing employees with admin access. This is far from theoretical. Just imagine the kind of money your average nation state has laying around to bribe someone with internal access.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#39

Post by 440bx »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

Yeah I tend to agree. For me Mythos' principal risk in my mind is saturation through being able to do bad things faster. Vulnerabilities are found and fixed - that's life. What is a problem is identifying and prioritising vulnerabilities. A miscategorisation or misidentification may lead to an extended attack window of a vulnerability. If a cloud provider, or multiple cloud providers are open to something there then everyone is in trouble. That's a pretty big nightmare scenario for me where I currently am.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#40

Post by [deleted] »

monarchwadia wrote: post #25
iugtmkbdfil834 wrote: post #17

Earlier quoted context omitted.

There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.

Anecdata from a JS developer who has been in this ecosystem for 14 years. I'm actively moving away from Node.js and JavaScript in general. This has been triggered by recent spike in supply chain attacks. Backend: I'm choosing to use Golang, since it has one of the most complete standard libraries. This means I don't have to install 3rd party libraries for common tasks. It is also quite performant, and has great suppo…

[deleted]
Post reply on HN