Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

221–230 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#221

Post by mrgoldenbrown »

grvdrm wrote: post #177
stouset wrote: post #175

Earlier quoted context omitted.

“The alternative is that nothing will ever get released because devs will take forever making it perfect” is a really lame take. We have literally countless examples of software that devs have released entirely of their own volition when they felt it was ready. If anything, in my experience, software that’s written a little slower and to a higher standard of quality is faster -releasing in the long (and medium) run.…

I'm happy to be reoriented with examples. Please provide some? You said countless but mentioned none.

tex was pretty bug free.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#222

Post by wat10000 »

dylan604 wrote: post #199
grvdrm wrote: post #178

Earlier quoted context omitted.

That's the point I am making, and the point of asking "what is the alternative" Developers aren't alone in adhering to schedules. Many folks in many roles do it. All deal with missed deadlines, success, expectation management, etc. No one operates in magical no-timeline land unless they do not at all answer to anyone or any user. Not the predominant model, right? So rather than just say "you can blame the PMs" I'd lo…

Software release dates are so arbitrary though. We no longer make physical media that needs time to make and ship. Why does software need to be released on February 15th instead of March 7th?

You could ask the same question about the contents of the release. Why does software need to be released with features X, Y, and Z on March 7th when it could be released with features X and Y on February 15th?

It's inevitable that work will slip. That doesn't necessarily mean the release will slip. Sometimes you actually need the thing, but often the work is something you want to include in the release but don't absolutely have to. Then you can decide which tradeoff you prefer, delaying the release or reducing its scope.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#223

Post by Animats »

kevincox wrote: post #173
Animats wrote: post #59

Earlier quoted context omitted.

"It resolved its C2 domain through an Ethereum smart contract, querying public blockchain RPC endpoints. Traditional domain takedowns would not work because the attacker could update the smart contract to point to a new domain at any time." Does this mean firewalls now have to block all Ethereum endpoints?

That is a never-ending game of whack-a-mole. There are infinite places to put command and control data.

The attack has to find the control nodes. Domains and IP addresses can be turned off. With this approach, there's no way to stop the finding process even after the attack has been reverse-engineered, short of firewalling or shutting down crypto nodes.

What happens when Ethereum gets a takedown order?

More generally, what happens as the malware ecosystem integrates with the cryptocurrency ecosystem?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#224

Post by [deleted] »

ryandrake wrote: post #107
KronisLV wrote: post #101

Earlier quoted context omitted.

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

> > We know how to write software with very few bugs > Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. I mean, we do know how to do it, but we don't because business needs tend to throw quality under the bus in exchange for almost everything else: (especially) speed to develop, but also developer comfort, feature cram, visual refreshes, and so on always trump bugs, so every projec…

[deleted]

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#225

Post by cookiengineer »

The fun part is that Google Safebrowsing doesn't even flag the malicious company's website.

And on their pricing page they offer all plugins as a bundle for 0 USD per year! What a steal! /s

Don't click on this, I would assume it may contain malware: https://essentialplugin[.]com/pricing/

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#226

Post by usefulcat »

grvdrm wrote: post #177
stouset wrote: post #175

Earlier quoted context omitted.

“The alternative is that nothing will ever get released because devs will take forever making it perfect” is a really lame take. We have literally countless examples of software that devs have released entirely of their own volition when they felt it was ready. If anything, in my experience, software that’s written a little slower and to a higher standard of quality is faster -releasing in the long (and medium) run.…

I'm happy to be reoriented with examples. Please provide some? You said countless but mentioned none.

I'd say SQLite is one good example:

https://sqlite.org/chronology.html

Regular releases for over a quarter of a century now, and it's renowned for its reliability.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#227

Post by latentframe »

This looks to be more than just a security bug and rather an incentive problem because you can buy trust with plugin installs numbers and reputation but there’s no mechanism to reprice that trust after the ownership gets changed so the attackers just buy the distribution and monetize it later and that makes this kind of attack economically rational, so it gets reproduced often

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#228

Post by eru »

chii wrote: post #168
rcxdude wrote: post #159

Earlier quoted context omitted.

That software also often has bugs. It's usually a bit more likely that they are documented, though, and unlikely to cause a significant failure on their own.

building around bugs that you know exists but dont know where is also a part of it. Reliability in the face of bugs. The mere existence of bugs isn't enough to call the software buggy, if the outcome is reliable (e.g., a triple module redundancy).

For a silly example, see how Python programs have plenty of bugs, but they still (usually) don't allow for the kind of memory exploits that C programs give you.

You could say that Python is designed around preventing these memory bugs.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#229

Post by joquarky »

exogenousdata wrote: post #93
tclancy wrote: post #76

Earlier quoted context omitted.

>if they're rational (an assumption that is debatable, of course) Feels like crime is an almost perfect simulation of the free market: almost/ all of the non-rational actors will be crowded out by evolutionary pressure to be better at finding the highest expected values, where EV would be something like [difficulty to break in] x [best-guess value of access].

This is a total tangent. However note that the creator of the ‘free market’ idea, Adam Smith, wasn’t an advocate for zero law/regulation regulation. In fact Chapter 10 of his “Wealth of Nations,” specifically states, “When the regulation, therefore, is in favour of the work-men, it is always just and equitable.” He goes on to explain that regulation that benefits the masters can wind up being unjust. Smith’s concept…

I hate getting old because I can never remember this when it's relevant.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#230

Post by whattheheckheck »

btown wrote: post #142
AlBugdy wrote: post #133

Earlier quoted context omitted.

> This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. Mythos will most likely not be the main thing that changes the infosec world, but AI in general will. Maybe in a few years or…

IMO the thing that AI will change is the type of target. It's reasonable to assume that if you launch a website for a small business nowadays - sure, you'll get phishing attempts, port scans, attempts to submit SQL injections into your signup forms, etc. But you won't get the equivalent of a sophisticated actor's spear-phishing efforts, highly customized supply chain attacks on likely vendor data, the individualized…

They're gonna shut the internet down by country
Post reply on HN