Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

181–190 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#181

Post by lifeisstillgood »

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

>>> We know how to write software with very few bugs (although we often choose not to)

I see this as primarily a social issue - OSS projects are frequently free of the WTF bugs enterprise software can suffer from (things that one lone developer with access to their own OS would never do - call it “I can’t install X so no logging at all happens”) and frequently free of the bugs that a lone developer would slowly fix (call it “proof of concept got released because a rewrite would need approval” bugs). That alone removes entire classes of bugs before we it logic bugs and off by one errors.

The social cost of “is that honestly the best you can do” is enormous, and being part of a dysfunctional organisation allows human nature to stick on “in this place, in this culture - yes”

Chnaging that culture in a small team is possible - at scale it’s really costly

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#182

Post by dwd »

SunshineTheCat wrote: post #86
toniantunovi wrote: post #45

The supply chain attack surface in WordPress plugins has always been particularly dangerous because the ecosystem encourages users to install many small single-purpose plugins from individual developers, most of whom aren't security-focused organizations. Buying out an established plugin with a large install base is a clever approach because you inherit years of user trust that took the original developer a long time…

I've long since stopped building WordPress sites for clients, but you would be blown away by the number of people who have installed the free version of Securi or Wordfence, zero configuration, and then assume their site is completely safe from attacks.

You absolutely can't rely on the free version of WordFence. It should also be the last line of defense to handle anything that can't get caught by the server WAF.

I recently cleaned a WordPress site (that I now get to manage) of some malware that had multiple redundant persistence layers and the attacker had whitelisted the folders in the WordFence scan. Was actually kind of handy as a checklist to see if I'd missed anything.

What WordFence did manage to do was email an alert that there had been an unauthorised admin login as their admin password had been compromised.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#183

Post by lifeisstillgood »

KronisLV wrote: post #101
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

>>> often due to factors outside of their control.

That’s the beauty of OSS - the level we could write code is way less than the level the culture / timescale / management allows. I recently saw OSS as akin to (good) journalism for enterprise - asking why is this hidden part of society not doing the minimum (jails, corruption etc).

Free software does sooo much better compared to much in-house it is like sunlight

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#184

Post by gtsop »

readitalready wrote: post #122
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

rogue nations such as North Korea Is North Korea really a "rogue nation" anymore? What does that even mean when the US, which is currently led by a convicted felon, is literally and unapologetically stealing resources from places like Venezuela and Iran?

Rogue nation = not under strict USA control.

If we wanted to treat words literally, the true rogue nation is USA. The only nation on earth to have actually dropped nukes on people. Have been prooved to spy on the entire world population. Plants coups around the globe. Invades any country they fancy in the name of democratization.

If that ain't a rogue nation I don't know what is

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#186

Post by pants2 »

One interesting note is the plugins were acquired on Flippa, which is a general marketplace to buy/sell software businesses, not limited to WP plugins.

What I worry about are the long tail of indie apps/extensions/plugins that can get acquired under good intentions and then weaponized. These apps are probably worth more to a threat actor than someone who wants to operate the business genuinely.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#187

Post by PaulHoule »

colonCapitalDee wrote: post #153
bruckie wrote: post #112

Earlier quoted context omitted.

> Do we, really? Yes, or pretty close to it. What we don't know how to do (AFAIK) is do it at a cost that would be acceptable for most software. So yes, it mostly gets done for (components of) planes, spacecraft, medical devices, etc. Totally agreed that most software is a morass of bugs. But giving examples of buggy software doesn't provide any information about whether we know how to make non-buggy software. It onl…

Then we can't do it. Cost is a requirement

Also people keep insisting on using unsafe languages like C.

It depends on exactly what you are doing but there are many languages which are efficient to develop in if less efficient to execute like Java and Javascript and Python which are better in many respects and other languages which are less efficient to develop in but more efficient to run like Rust. So at the very least it is a trilemma and not a dilemma.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#188

Post by adrianwaj »

gkoberger wrote: post #14
meteyor wrote: post #8

So how was this attack gonna generate "revenue" for the attacker? What kind of info did they get hold of?

They're adding backlinks to other sites. They're either making revenue from those sites, or (more likely) selling backlinks to unsavory products.

Article: "It only showed the spam to Googlebot, making it invisible to site owners." - so it was really only about SEO for themselves or their customers.

With regards to "Your Ad Here" type services using crypto: are Adshares, Coinzilla, Bitmedia or A-Ads any good? Perhaps micropayments are what makes this space interesting right now.

I suppose it's the "unsavory" aspect of the things being peddled that can make it hard/expensive to get visible inbound links.

Article: "It resolved its C2 domain through an Ethereum smart contract, querying public blockchain RPC endpoints. Traditional domain takedowns would not work because the attacker could update the smart contract to point to a new domain at any time."

I wonder if that scheme be used for anything positive, like avoiding censorship? That's pretty important if you are sharing information about new inventions around, say, free energy as an antidote to cost-of-living and the "scourge of AI."

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#189

Post by empressplay »

All my sites got pwned through this. Attempts to restore from backup just got pwned again in minutes. Ended up using Claude to create static sites from the database and the assets.

I'm never using Wordpress again and I strongly suggest nobody else does either.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#190

Post by dawnerd »

da_chicken wrote: post #156
antaviana wrote: post #129

Crypto has single handedly created a very large malware industry and has also made information security a massive industry. Ban crypto and both industries will become way, way smaller.

No, data exfiltration is just as lucrative as crypto. We are unfortunately long past the point where viruses would frequently be merely annoying.

Just about every exploited site I've had to deal with has been some form of crypto miner.
Post reply on HN