Ah WordPress, the ever growing security nightmare
Someone bought 30 WordPress plugins and planted a backdoor in all of them
241–250 of 368 posts
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#242I really wish that the FAIR package manager project had been successful, but they recently gave up after the WordPress drama died down. https://fair.pm/ FAIR has a very interesting architecture, inspired by atproto, that I think has the potential to mitigate some of the supply-chain attacks we've seen recently. In FAIR, there's no central package repository. Anyone can run one, like an atproto PDS. Packages have DIDs…
For wordpress plugin and chrome/firefox extension,
the most common channel of attack is -- the developer just sold the plugin for money.
They sold the developer key, the domain name, the organization or whatever needed to publish that plugin as updates.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#243Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#244Do browser extensions next…
Chrome and Firefox extension were under the same attack for years...
They just got more eye and react a little bit (just a little bit) faster.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#245Earlier quoted context omitted.
There is -change in ownership
What is "change of ownership" anyway? One can just sell their username/password/private key. The plugin directory maintainer or the end user not necessary know there is a change of ownership.
Yes, fraud is possible, no reason to limit the surface area
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#246Earlier quoted context omitted.
That won't happen, because time to market is the biggest obstacle between the developers and the monies. If leftpad, electron, Anthropic, Zed, $shady_library$ gonna help developers beat that obstacle, they'll do it instantly, without thinking, without regret. Because an app is not built to help you. It's built to make them monies. It's not about the user, never. Note: I'm completely on the same page with you, with a…
It’s not always about money. It’s also about the time of the developer. Even for a hobby project you may burn out before to actually deliver it.
Times are monies though
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#247[dead]
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#248Crypto has single handedly created a very large malware industry and has also made information security a massive industry. Ban crypto and both industries will become way, way smaller.
No, data exfiltration is just as lucrative as crypto. We are unfortunately long past the point where viruses would frequently be merely annoying.
How do you pay for data exfiltration ransoms or to purchase stolen data? My take is that if you remove crypto, you will hamper greatly these transactions.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#249Earlier quoted context omitted.
Or worse sudo curl URL | bash
made even worse by the fact that it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side. This means the attack can be "invisible", as a cursory glance at the output of the curl can be misleading. You _have_ to curl with piping the output into a file (like | cat), and examine that file to detect any anomaly.
> it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side
That sounded really interesting, so I looked it up and found this article from 2016 if anyone else is interested: https://web.archive.org/web/20250622061208/https://www.idont...
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#250Earlier quoted context omitted.
Then we can't do it. Cost is a requirement
Also people keep insisting on using unsafe languages like C. It depends on exactly what you are doing but there are many languages which are efficient to develop in if less efficient to execute like Java and Javascript and Python which are better in many respects and other languages which are less efficient to develop in but more efficient to run like Rust. So at the very least it is a trilemma and not a dilemma.
> if less efficient to execute like Java and Javascript and Python
One of these is not like the others...
Java (JVM) is extremely fast.