Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

321–330 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#321

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

I always force myself to do this too. The only 3rd party python library I regularly use is "requests" basically —a dependency that comes with its own baggage, see the recent controversy about "chardet"— but I go out of my way to grab it from pip instead installing it via pip. :-)

Something like this:

    try:
        import requests
    except ImportError:
        from pip._vendor import requests

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#322

Earlier quoted context omitted.

rogue nations such as North Korea Is North Korea really a "rogue nation" anymore? What does that even mean when the US, which is currently led by a convicted felon, is literally and unapologetically stealing resources from places like Venezuela and Iran?

Maybe ask South Koreans what's their standing on the matter. Not everything is about USA.

Why ask South Korean instead of North Korea?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#325

It seems obvious to me that there should now be a concerted and open effort to detect malware in supply chains based on AI-based scanning. Sure, there will be an arms race in malware obfuscation, but that was coming anyway. Manual review is useless at this scale - it is just not happening.

This is actually where LLMs could be in advantage. Any code which is not clean (i.e. could be obfuscated) will trigger alarms and deeper inspection. It is much more difficult to create a good "underhanded" exploit that LLM will miss than it is to do the same for humans, imho.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#326

Earlier quoted context omitted.

Software release dates are so arbitrary though. We no longer make physical media that needs time to make and ship. Why does software need to be released on February 15th instead of March 7th?

> Why does software need to be released on February 15th instead of March 7th? Because it has to be released at some point, and without picking a point in advance, you can never reach it. https://en.wikipedia.org/wiki/Parkinson%27s_law

I disagree with that entirely. Some features just take longer to develop. If that feature is part of the release, then release it when it is finished and not kind of working. If that feature is just not achievable, then PMs have really screwed up their role by putting it in the release in the first place.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#327

Earlier quoted context omitted.

Is this a win for .NET where the mothership provides almost all what you need?

.NET is great because you use a FOSS library and then a month later the developer changes the licence and forces you to either pay a subscription for future upgrades or swap it out.

Yeah why is this so common in .NET?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#328
post #36

Earlier quoted context omitted.

> And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake". LAPSUS$ was prolific by just bribing employees with admin access. This is far from theoretical. Just imagine the kind of money your average nation state has laying around to bribe someone with internal access.

I started to write a comment about how low they probably were able to bribe people for but found this article [0] which put the number higher than I expected: > One of the core LAPSUS$ members who used the nicknames “Oklaqq” and “WhiteDoxbin” posted recruitment messages to Reddit last year, offering employees at AT&T, T-Mobile and Verizon up to $20,000 a week to perform “inside jobs.” That said, this is but one insta…

Go on Swapd and look at how cheap it is to buy an insider at Meta, TikTok etc.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#329

This is probably a controversial opinion but this case is yet another example of why it should be prohibited to sell repositories and storefronts. If you want to take over someone else’s user base you should be forced to display a message to the users and actively ask them whether they trust the new owner as well. Simply passing the whole thing on to someone else in secret who could then compromise the WordPress plug…

[dead]

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#330

Earlier quoted context omitted.

.NET is great because you use a FOSS library and then a month later the developer changes the licence and forces you to either pay a subscription for future upgrades or swap it out.

Yeah why is this so common in .NET?

Enterprise usage. Devs know companies will just pay out. Easier than trying to get sponsored.
Post reply on HN