Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

101–110 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#101

Post by KronisLV »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> We know how to write software with very few bugs (although we often choose not to)

Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort.

Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, or Spring Boot or Java in general, or Oracle drivers, or whatever unlucky thread pooling solution has to manage those Oracle connections, or kswapd acting up in RHEL compatible distros and eating CPU to a degree to freeze the whole system instead of just doing OOM kills, or Ansible failing to make systed service definitions be reloaded, or llama.cpp speculative decoding not working for no good reason, or Nvidia driver updates bringing the whole VM down after a restart, or Django having issues with MariaDB or just general weirdness around Celery and task management and a million different things.

No matter where I look, up and down the stack, across different OSes and tech stacks, there are bugs. If there is truly bug free code (or as close to that as possible) then it must be in planes or spacecraft, cause when it comes to the kind of development that I do, bug free code might as well be a myth. I don't think everyone made a choice like that - most are straight up unable to write code without bugs, often due to factors outside of their control.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#102

Post by stratts »

toniantunovi wrote: post #45

The supply chain attack surface in WordPress plugins has always been particularly dangerous because the ecosystem encourages users to install many small single-purpose plugins from individual developers, most of whom aren't security-focused organizations. Buying out an established plugin with a large install base is a clever approach because you inherit years of user trust that took the original developer a long time…

Not only that, but so many people are reluctant to pay for anything so your average installation is chock full of freemium plugins. I've worked on plenty of sites whose admin page looked a bit like the IE6 toolbar meme.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#103

Post by aksss »

I can foresee a modern code-signing regimen with paid gatekeepers coming to mitigate the risk of supply chain attacks. Imagine the purported strength of mythos automating scans of PRs or releases with some manner of indelible and traceable certification. There's some industrious company - a modern verisign of old - that will attempt to drop in a layer of $250-500 per year fees for that service, capture the app stores to require it. Call me a cynical bastard, but "I was there, Gandalf".

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#104

Post by joshstrange »

Shank wrote: post #36
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake". LAPSUS$ was prolific by just bribing employees with admin access. This is far from theoretical. Just imagine the kind of money your average nation state has laying around to bribe someone with internal access.

I started to write a comment about how low they probably were able to bribe people for but found this article [0] which put the number higher than I expected:

> One of the core LAPSUS$ members who used the nicknames “Oklaqq” and “WhiteDoxbin” posted recruitment messages to Reddit last year, offering employees at AT&T, T-Mobile and Verizon up to $20,000 a week to perform “inside jobs.”

That said, this is but one instance and I'd imagine that on the whole they are able to bribe people at much lower numbers. See also: how little it takes to bribe some government officials.

[0] https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lap...

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#105

Post by search_facility »

jacquesm wrote: post #55
Shank wrote: post #36

Earlier quoted context omitted.

> And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake". LAPSUS$ was prolific by just bribing employees with admin access. This is far from theoretical. Just imagine the kind of money your average nation state has laying around to bribe someone with internal access.

And because it is surprisingly difficult to distinguish between 'oops' and 'malice' a lot of the actual perps get away with it too, as long as they limit their involvement. In-house threats are an under appreciated - and somewhat uncomfortable - topic for many companies, they don't have the funds to do things by the book but they do have outsized responsibilities and pray that they can trust their employees.

But on the other hand, adding LLM with strong guards (not yet here but doable for popular attack vectors) into the human loop can drastically eliminate insider factor, imho.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#106

Post by joshstrange »

monarchwadia wrote: post #25
iugtmkbdfil834 wrote: post #17

Earlier quoted context omitted.

There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.

Anecdata from a JS developer who has been in this ecosystem for 14 years. I'm actively moving away from Node.js and JavaScript in general. This has been triggered by recent spike in supply chain attacks. Backend: I'm choosing to use Golang, since it has one of the most complete standard libraries. This means I don't have to install 3rd party libraries for common tasks. It is also quite performant, and has great suppo…

> React happily also has 0 dependencies,

Ok, but it has 112 devDependencies, I'm not really sure "0 dependencies" best describes React.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#107

Post by ryandrake »

KronisLV wrote: post #101
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

> > We know how to write software with very few bugs

> Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort.

I mean, we do know how to do it, but we don't because business needs tend to throw quality under the bus in exchange for almost everything else: (especially) speed to develop, but also developer comfort, feature cram, visual refreshes, and so on always trump bugs, so every project ends up with bugs.

I have a few hobby projects which I would stick my neck out and say have no bugs. I know, I'm going to get roasted for this claim, but the projects are ultra simple enough in scope, and I'm under no pressure to ever release them publicly, so I was able to prioritize getting them right. No actual businesses are going to be doing this level of polish and care, and they all need to cut corners and actually ship, so they have bugs. And no ultra-complex project (even if it's done with love and care) is capable of this either, purely due to its size and number of moving parts.

So, it's not like we don't know how to do it, but that we choose not to for practical reasons.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#108

Post by bluGill »

kibwen wrote: post #43
bluGill wrote: post #15

Earlier quoted context omitted.

What user is going to check dependencies like that?

Users who don't care about security are screwed no matter what you do. The best you can do is empower those users who do care about security.

That cannot work. Nor should it work. However can we make things so that users don't need to care in the first place?

Note that the above probably isn't 100% answerable. However it needs to be the goal. A few people need to care and take care of this for everyone. Few needs to be a large enough to not get overwhelmed by the side of the job.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#109

Post by johnsmith1840 »

EGreg wrote: post #51

[flagged]

I'm not a crypto expert but how would that have solved this?

1. Make a website 2. Website has trusted code 3. Code update adds a virus

How do your suggestions fix those? Not trying to be dismissive I work on zero trust security perhaps I'm missing something crypto has to offer here?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#110

Post by cyanydeez »

Shank wrote: post #36
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake". LAPSUS$ was prolific by just bribing employees with admin access. This is far from theoretical. Just imagine the kind of money your average nation state has laying around to bribe someone with internal access.

Keep in mind, the billionaires seem to think they can crash all this into the ground, and some how survive by buying their own miltaries.

The scale of how society works is lost on the greedy

Post reply on HN