Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

271–280 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#271

Post by RobotToaster »

KronisLV wrote: post #101
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

> Do we, really?

Formal verification to EAL7[0] in theory, as long as your requirements are correct.

In practice I'm not aware of any bugs being discovered in any EAL7 software, but it's so expensive there isn't a lot of it.

[0]https://en.wikipedia.org/wiki/Evaluation_Assurance_Level

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#272

Post by maltris »

empressplay wrote: post #189

All my sites got pwned through this. Attempts to restore from backup just got pwned again in minutes. Ended up using Claude to create static sites from the database and the assets. I'm never using Wordpress again and I strongly suggest nobody else does either.

You likely restored a compromised backup because the backdoor(s) were already laying there. Or you restored to a theme/plugin with a vulnerability and had it quickly exploited again.

There is some lessons to be learned from your way of trying to fix it. Suggesting not to use a software that is in its core pretty stable and safe, is not one of them.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#274

Post by brikym »

elric wrote: post #273

A tale as old as time. And hard to defend against. Did the sellers know their plugins were going to be abused? Is there some kind of seller liability in cases like this?

I think a big proportion of them wouldn't 'know'. At least in my experience considering selling out the partners or buyers will try to keep a good image. But there are smells. Maybe the partner has their HQ in place that is a hotspot for intelligence/security industry or the deal is at such a price that it would only make sense if the asset as purchased for nefarious purposes.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#275

Post by crabmusket »

Animats wrote: post #59
chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

"It resolved its C2 domain through an Ethereum smart contract, querying public blockchain RPC endpoints. Traditional domain takedowns would not work because the attacker could update the smart contract to point to a new domain at any time." Does this mean firewalls now have to block all Ethereum endpoints?

Should something like a WordPress server not have a domain allowlist for outbound connections? Does WordPress need to connect to arbitrary domains?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#276

Post by whstl »

colonCapitalDee wrote: post #153
bruckie wrote: post #112

Earlier quoted context omitted.

> Do we, really? Yes, or pretty close to it. What we don't know how to do (AFAIK) is do it at a cost that would be acceptable for most software. So yes, it mostly gets done for (components of) planes, spacecraft, medical devices, etc. Totally agreed that most software is a morass of bugs. But giving examples of buggy software doesn't provide any information about whether we know how to make non-buggy software. It onl…

Then we can't do it. Cost is a requirement

Is having problematic features that causes problems also a requirement?

The answer to the above question will reveal if someone an engineer or a electrician/plumber/code monkey.

In virtually every other engineering discipline engineers have a very prominent seat at the table, and the opposite is only true in very corrupt situations.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#277

Post by benbristow »

dnnddidiej wrote: post #161
tmoertel wrote: post #83

Earlier quoted context omitted.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

Is this a win for .NET where the mothership provides almost all what you need?

.NET is great because you use a FOSS library and then a month later the developer changes the licence and forces you to either pay a subscription for future upgrades or swap it out.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#278

Post by neurostimulant »

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Maybe we should go back to kitchen-sink frameworks so most functionality you need is covered by the fat framework. I'm still using django and it keeps my python project's dependency relatively low :)

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#279

Post by whstl »

jjav wrote: post #250
PaulHoule wrote: post #187

Earlier quoted context omitted.

Also people keep insisting on using unsafe languages like C. It depends on exactly what you are doing but there are many languages which are efficient to develop in if less efficient to execute like Java and Javascript and Python which are better in many respects and other languages which are less efficient to develop in but more efficient to run like Rust. So at the very least it is a trilemma and not a dilemma.

> if less efficient to execute like Java and Javascript and Python One of these is not like the others... Java (JVM) is extremely fast.

The JVM has been extremely fast for a long long time now. Even Javascript is really fast, and if you really need performance there’s also others in the same performance class like C#, Rust, Go.

Hot take, but: Performance hasn’t been a major factor in choosing C or C++ for almost two decades now.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#280

Post by rvnx »

whstl wrote: post #276
colonCapitalDee wrote: post #153

Earlier quoted context omitted.

Then we can't do it. Cost is a requirement

Is having problematic features that causes problems also a requirement? The answer to the above question will reveal if someone an engineer or a electrician/plumber/code monkey. In virtually every other engineering discipline engineers have a very prominent seat at the table, and the opposite is only true in very corrupt situations.

Unlimited budget and unlimited people won't solve unlimited problems with perfection.

Even basic theorems of science are incorrect.

Post reply on HN