Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

211–220 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#211

Post by weird-eye-issue »

0xbadcafebee wrote: post #205
weird-eye-issue wrote: post #200

Earlier quoted context omitted.

If the sellers are in India and the buyer is in who knows where, how is your legal framework going to actually hold them accountable? Besides, it's not reasonable to hold the sellers accountable. that's a very dangerous precedent.

It works like any other case of liability. If the seller is in the US, the seller is held liable if they transfer to a foreign entity who isn't accountable to US laws (because the user/customer would have no recourse if the buyer does something evil). Opposite is true if the buyer is in the US. If only the user is in the US, there's not much they can do but use the courts or politicians to try to get justice overseas…

So you want people who sell a business to be open to liability for things that the new owner does? Don't you see what kind of negative consequences that would have?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#212

Post by post-it »

BenjiWiebe wrote: post #166
stratts wrote: post #102

Earlier quoted context omitted.

Not only that, but so many people are reluctant to pay for anything so your average installation is chock full of freemium plugins. I've worked on plenty of sites whose admin page looked a bit like the IE6 toolbar meme.

Hmmm... I'm reluctant to pay for WordPress plugins because a bunch of them are also single purpose plugins from random developers, and of questionable quality.

And they also make your WP admin page look like an IE6 toolbar.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#214

Post by chii »

Animats wrote: post #61
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Or worse sudo curl URL | bash

made even worse by the fact that it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side.

This means the attack can be "invisible", as a cursory glance at the output of the curl can be misleading.

You _have_ to curl with piping the output into a file (like | cat), and examine that file to detect any anomaly.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#215

Post by chii »

nulltrace wrote: post #158
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Lockfiles help more than people realize. If you're pinned and not auto-updating deps, a package getting sold and backdoored won't hit you until you actually update. The scarier case is Dependabot opening a "patch bump" PR that probably gets merged because everyone ignores minor version bumps.

I wish those PRs made by the bot can have a diff of the source code of those upgraded libraries (right in the PR, because even if in theory you could manually hunt down the diffs in the various tags...in practise nobody does it).

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#216

Post by iamkeithmccoy »

raincole wrote: post #174
dnnddidiej wrote: post #161

Earlier quoted context omitted.

Is this a win for .NET where the mothership provides almost all what you need?

C#/.NET is a good example showing no matter how much programmers you have, how much capital you hold, it's still impossible to make a 'batteries-included' ecosystems because the real world is simply too vast.

Say what you want but I can write a production backend without any non-Microsoft dependencies. Everything from db and ORM to HTTP pipeline/middleware to json serialization to auth to advanced logging (OTel). Yes, sometimes we opt for 3rd party packages for advanced scenarios but those are few and far between, as opposed to npm/js where the standard library is small and there is little OOTB tooling and your choices are to reinvent a complex wheel or depend on a package that can be exploited. I argue the .NET model is winning the new development ecosystem.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#217

Post by ChrisMarshallNY »

KronisLV wrote: post #101
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

> Do we, really?

Yes. There’s a ton of lessons learned, best practices, etc. We’ve known for decades.

It’s just expensive and difficult. Since end-users seem to have no issue, paying for crud, why bother?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#218

Post by dakolli »

neya wrote: post #210
tmoertel wrote: post #83

Earlier quoted context omitted.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

> I go out of my way to avoid using external packages. I go out of my way to avoid Javascript. Because in all my years of writing software, it has 100% of the time been the root cause for vulnerabilities. These days I just use LiveView.

HTMX > Live View

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#219

Post by neya »

dakolli wrote: post #218
neya wrote: post #210

Earlier quoted context omitted.

> I go out of my way to avoid using external packages. I go out of my way to avoid Javascript. Because in all my years of writing software, it has 100% of the time been the root cause for vulnerabilities. These days I just use LiveView.

HTMX > Live View

Sure, if that works for you, then great.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#220

Post by cookiengineer »

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

And now you've figured out the benefit of a language with a strong set of core libraries and an stdlib that come with it.

Go has its opinions and I don't agree with many of them, but the upstream packages combined with golang.org/x allow you to build pretty much anything. And I really like the community that embraced a trend of getting close to zero dependencies for their projects and libraries.

The only dependency I usually have for my projects are C binding or eBPF related. For most of the other parts I can just choose the stdlib.

Post reply on HN