Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

91–100 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#91

Post by thefounder »

bayindirh wrote: post #30
thefounder wrote: post #26

Earlier quoted context omitted.

It’s not always about money. It’s also about the time of the developer. Even for a hobby project you may burn out before to actually deliver it.

I'll say depends. Personally, my hobby projects are about me, just shared with the world because I believe in Free Software. Yet, I'm not obliged to deliver anything to anyone. I'll develop the tool up to the point of my own needs and standards. I'm not on a time budget, I don't care. Yes, I personally try to reach to the level of best ones out there, but I don't have a time budget. It's a best effort thing.

In reality you are always on a time budget that is correlated with the output of the software you develop.(I.e is it worth it your time?) I’ve found out that the most important thing is to get feedback early even from yourself using whatever software you develop. If you develop a small effort piece of software you can ship it before other stuff is starting to compete for your time. But if it takes a year or more before even you can make any use of it I guarantee you that the chances of shipping it diminishes significantly. Other stuff competes for your time(I.e family, other hobbies etc).

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#92

Post by pessimizer »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos.

The hyperbole was press released and consciously engineered. It consists entirely of the company who made Mythos, the usual captured media outlets who follow the leader, and the usual suspects from social media.

The reaction to it as if it is meaningful just fluffs it up more.

These are unprofitable companies trying to suck up maximum possible investment until they become something that the government can justify bailing out with tax money when they fail. Once you've crossed that line, you've won.

Some model that is super good at finding vulnerabilities will be run against software by the people trying to close those vulnerabilities far more often than by anyone trying to exploit them.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#93

Post by exogenousdata »

tclancy wrote: post #76
jruohonen wrote: post #49

Earlier quoted context omitted.

> but they don't need FreeBSD exploit-writing capabilities for that. That's a solid point. There was a piece the other day in the Register [1] that studying supply chains for cost-benefit-risk analysis is how some of them increasingly operate. And, well, why wouldn't they if they're rational (an assumption that is debatable, of course)? [1] https://www.theregister.com/2026/04/11/trivy_axios_supply_ch...

>if they're rational (an assumption that is debatable, of course) Feels like crime is an almost perfect simulation of the free market: almost/ all of the non-rational actors will be crowded out by evolutionary pressure to be better at finding the highest expected values, where EV would be something like [difficulty to break in] x [best-guess value of access].

This is a total tangent. However note that the creator of the ‘free market’ idea, Adam Smith, wasn’t an advocate for zero law/regulation regulation.

In fact Chapter 10 of his “Wealth of Nations,” specifically states, “When the regulation, therefore, is in favour of the work-men, it is always just and equitable.” He goes on to explain that regulation that benefits the masters can wind up being unjust.

Smith’s concept of ‘laissez-faire’ was novel back in the day. But by today’s standards, some of his economic opinions might even be considered “collectivist.”

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#95

Post by amarant »

soulofmischief wrote: post #79
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

Well, Cryptocurrencies are part of said new era. They aren't strictly a problem that made things worse: they're a technology that comes with tradeoffs. The cat is out of the bag and we have to design around technologies that are here to stay in whatever capacity. Distributed, cryptography-based currencies/tokens are one of those technologies.

Yes, on the one hand, they enable a lot of shady illegal business, but in the other hand, they also destroy the environment while doing it, so it's really a toss up whether cryptocurrency is good or bad overall!

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#96

Post by sjrd »

lukax wrote: post #64
jagged-chisel wrote: post #29

Earlier quoted context omitted.

Frontend: eh - you could pick something that targets wasm. Definitely a tradeoff with its own headaches.

Rust wasm ecosystem also needs a lot of crates to do anything useful, a lot of them unmaintained.

Try Scala? You only need one 0-dependency library for UI (Laminar), and you're good to go.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#98

Post by LtWorf »

tmoertel wrote: post #83
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

I generally limit myself to what's available in my distribution, if the standard library doesn't provide it. But normally I never use requests because it's not worth it I think to have an extra dependency.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#99

Post by wordspotting »

burningChrome wrote: post #84
jacquesm wrote: post #55

Earlier quoted context omitted.

And because it is surprisingly difficult to distinguish between 'oops' and 'malice' a lot of the actual perps get away with it too, as long as they limit their involvement. In-house threats are an under appreciated - and somewhat uncomfortable - topic for many companies, they don't have the funds to do things by the book but they do have outsized responsibilities and pray that they can trust their employees.

Also hard to track when the offending employee is a contractor or simply exits stage left to another company. Where he could also offer up his services to make another "blunder" that would grant access to these groups.

Another framing would be we will release your mother if you plant this backdoor. Could be a good plot for a short story? This attack vector has been available to Nation States since ages ago, stealing blueprints etc. Why are we acting surprised that this could be applied more effectively in digital age?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#100

Post by IanCal »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

These are vastly different scales though. “If North Korea wanted to, they could spend a lot of money and get into your system” is wildly different to “anyone with a few bucks who can ask ‘please find an exploit for Y’ can get in”
Post reply on HN