Accepting unknown packages is just another form of vibe coding.
Someone bought 30 WordPress plugins and planted a backdoor in all of them
121–130 of 368 posts
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#122This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
rogue nations such as North Korea
Is North Korea really a "rogue nation" anymore? What does that even mean when the US, which is currently led by a convicted felon, is literally and unapologetically stealing resources from places like Venezuela and Iran?
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#123Earlier quoted context omitted.
> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…
> No matter where I look, up and down the stack, across different OSes and tech stacks, there are bugs. I’m not sure I’d go quite as far as GP, but they did caveat that we often choose not to write software with few bugs. And empirically, that’s pretty true. The software I’ve written for myself or where I’ve taken the time to do things better or rewrite parts I wasn’t happy with have had remarkably few bugs. I have c…
> I’m not sure I’d go quite as far as GP, but they did caveat that we often choose not to write software with few bugs. And empirically, that’s pretty true.
Blame PMs for this. Delivering by some arbitrary date on a calendar means that something is getting shipped regardless of quality. Make it functional for 80% of use, then we'll fix the remaining bits in releases. However, that doesn't happen as the team is assigned new task because new tasks/features is what brings in new users, not fixing existing problems.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#124Earlier quoted context omitted.
I started to write a comment about how low they probably were able to bribe people for but found this article [0] which put the number higher than I expected: > One of the core LAPSUS$ members who used the nicknames “Oklaqq” and “WhiteDoxbin” posted recruitment messages to Reddit last year, offering employees at AT&T, T-Mobile and Verizon up to $20,000 a week to perform “inside jobs.” That said, this is but one insta…
If they were looking to access government back doors at these providers then it would not be your usual hack - and worth a lot more. I have no idea if this is how an entire domestic surveillance network got strung up, but it would make sense at those numbers (though those numbers still seem very low for such a betrayal and potential consequences)
I'm thinking those prices are just for large sets of phone number ports/clones to get past 2fa on valuable accounts.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#125This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
Any tool that is that good at vulnerability research is bound to have some killer capabilities in attack surface mapping and exploitation…
Which is not to disagree with the thrust of your point, I think: it’s even more about the fundamentals than it was yesterday. The bar for “secure enough” is what is being raised.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#126So how should everyday users attempt to avoid this risk? And how to stay vigilant?
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#127[dead]
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#128At this point im not sure how we can reestablish trust in the software supply chain, especailly for small businesses.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#129Crypto has single handedly created a very large malware industry and has also made information security a massive industry.
Ban crypto and both industries will become way, way smaller.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#130This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
> This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. The hyperbole was press released and consciously engineered. It consists entirely of the company who made Mythos, the usual captured media outlets who follow the leader, and the usual suspects from social media. The reaction to it as if it is meaningful just fluffs it up more. These are unprofitable companies trying to suc…
It reminds me a bit of the Segway hype "they'll build complete cities around these".
Sure, you can find problems faster, but it's not like they'll find 20 NEW classes of bugs.