31–40 of 87 posts
Earlier quoted context omitted.
It sounds like that might have been the place that stole it?
Doesn't matter. A WordPress plugin/theme developer has no business altering the content of sites using their software.
It looks like the company involved is based in the U.K. and also seems likely this software and their usage of it is a violation of the Computer Misuse Act. One of their competitors should consider filing a complaint with the relevant authorities, so this gets formally investigated.
Earlier quoted context omitted.
I'd also like to add that the DDoS functionality isn't what really jumped out at me. It was the ability to reset your site's admin password remotely using a hard-coded password that anyone can read. And then there is also the ability to drop all your tables. When we contacted them before publishing via email, they explained that someone had been pirating their software so this was a countermeasure. (quote is in the W…
> I guess the idea was that they would destroy sites using pirated licenses. Isn't it GPL?
Earlier quoted context omitted.
While I don't disagree that this is horrible, perhaps the $tables array is hardcoded array.
It is not, you can check the post for the full context.
From pipdig https://www.pipdig.co/blog/sad-times/
Pathetic. If I'm reading this correctly, they're essentially admitting to some of the malicious features described by the researcher, but claiming that they were included for support purposes, or as a way of sabotaging sites using pirated versions of their plugin. 1. Including features which can remotely grant unauthorized access or cause damage to a user's web site is inappropriate under any circumstances . Even if…
Oh and they deleted repos apparently, gotta hide the evidence
Here's a second writeup, which also contains a response from pipdig: https://www.wordfence.com/blog/2019/03/peculiar-php-present-...
A developer at Pipdig wrote these lines of code and shipped it, I wonder how they felt. foreach ($tables as $table) { $wpdb->query("DROP TABLE $table"); }
Earlier quoted context omitted.
Doesn't matter. A WordPress plugin/theme developer has no business altering the content of sites using their software.
I don't know anything about WordPress, but isn't a plugin supposed to alter the content of the site using their software? If it didn't, why use it?