Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

obr.uk

Post reply on HN
Print view View original

11–20 of 127 posts

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#11

Post by kassner »

withinboredom wrote: post #6
cstuder wrote: post #3

Earlier quoted context omitted.

> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…

The main issue is that there isn't any governance to the plugin store. Once you have a plugin in there, you have free reign to do whatever you want with it. Getting it in there is a PITA though. For example, a library author and I created a plugin, but they wouldn't let me submit it because I wasn't the other author, and they wouldn't let him submit it because he wasn't me. True story.

TBF there is some scrutiny on existing plugins, the team is just extremely understaffed (it’s ran by volunteers after all). I got involved in a plugin that ended up getting de-listed for some minor ToS violations after several years of being “fine”, they re-reviewed the plugin with the same rigor as a new submission.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#12

Post by chippiewill »

cstuder wrote: post #3
kingkool68 wrote: post #2

What was the quirk?

> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…

> WordPress is a nice piece of software, but the plugin situation is getting worse and worse

The plugin situation is a mess largely because Wordpress isn't a nice piece of software.

It's popular, and functionally it's great, but the codebase is really showing its age. Wordpress has never properly rearchitected because it would break plugins on a scale that would endanger its dominance.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#14

Post by kstrauser »

cstuder wrote: post #3
kingkool68 wrote: post #2

What was the quirk?

> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…

To an outsider, its entire plugin ecosystem is so odd. Like the conversation about “nulled” plugins, where someone removes license-checking code from GPL-licensed plugins and then redistributes them, and whether that’s moral, or even legal, which of course it is, because that’s the entire point of the GPL.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#15

Post by shawabawa3 »

glenjamin wrote: post #8

There's a couple of passing mentions of Download Monitor, but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded I'm not clear from the doc which of these scenarios is what they're calling the "leak"

> but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded

A bunch of people were scraping commonly used urls based on previous OBR reports, in order to report as soon as it was live, as it common with all things of this kind

The mistake was that the URL should have been obfuscated, and only changed to the "clear" URL at publish time, but a plugin was bypassing that and aliasing the "clear" URL to the obfuscated one

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#16

Post by longwave »

glenjamin wrote: post #8

There's a couple of passing mentions of Download Monitor, but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded I'm not clear from the doc which of these scenarios is what they're calling the "leak"

It sounds like a combination of the Download Monitor plugin plus a misconfiguration at the web server level resulted in the file being publicly accessible at that URL when the developers thought it would remain private until deliberately published.

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#17

Post by jamesbelchamber »

M2Ys4U wrote: post #13

>During that period, it was accessed 43 times by 32 unique IP addresses I find this an implausibly low number. It was all over Bluesky, X etc., not to mention journo Signal and WhatsApp groups.

Possibly copies of the document rather than the original URL?

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#18

Post by logicchains »

M2Ys4U wrote: post #13

>During that period, it was accessed 43 times by 32 unique IP addresses I find this an implausibly low number. It was all over Bluesky, X etc., not to mention journo Signal and WhatsApp groups.

Maybe it was cached somewhere and most people were hitting the cache?

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#19

Post by dazc »

glenjamin wrote: post #8

There's a couple of passing mentions of Download Monitor, but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded I'm not clear from the doc which of these scenarios is what they're calling the "leak"

https://obr.uk/docs/dlm_uploads/OBR_Economic_and_fiscal_outl... 5.pdf

Not hard to guess really. Wouldn't they know this was likely and simply choose a less obvious file name?

Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

#20

Post by m4tthumphrey »

M2Ys4U wrote: post #13

>During that period, it was accessed 43 times by 32 unique IP addresses I find this an implausibly low number. It was all over Bluesky, X etc., not to mention journo Signal and WhatsApp groups.

Either that number was wrong like you say OR (and I am unfamiliar with Bluesky) the URL is loaded via Bluesky's browser (like X) and therefore Bluesky's own server IP was used (instead of the user's).

Edit: Or (and more likely) cached/copies of the original.

Post reply on HN