Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone bought 30 WordPress plugins and planted a backdoor in all of them

anchor.host

Post reply on HN
Print view View original

341–350 of 368 posts

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#341

Post by sunnybeetroot »

Pikamander2 wrote: post #317
stratts wrote: post #102

Earlier quoted context omitted.

Not only that, but so many people are reluctant to pay for anything so your average installation is chock full of freemium plugins. I've worked on plenty of sites whose admin page looked a bit like the IE6 toolbar meme.

The premium plugins are arguably even worse. Unlike the free plugins, they're not reviewed by the WordPress.org team, and if you stop paying for them then you'll lose access to their future plugin updates, including critical security fixes. I wouldn't say that their code quality is noticably higher, either; there have been countless CVEs for premium WordPress plugins over the years, and no shortage of discontinued/ab…

It makes sense that you wouldn’t receive updates if you stopped paying. You’re paying for the labour up until that point. It’s like paying to have your grass mowed and then complaining because it wasn’t mowed again in the future without you paying.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#342

Post by whyever »

bornfreddy wrote: post #325
lambdaone wrote: post #295

It seems obvious to me that there should now be a concerted and open effort to detect malware in supply chains based on AI-based scanning. Sure, there will be an arms race in malware obfuscation, but that was coming anyway. Manual review is useless at this scale - it is just not happening.

This is actually where LLMs could be in advantage. Any code which is not clean (i.e. could be obfuscated) will trigger alarms and deeper inspection. It is much more difficult to create a good "underhanded" exploit that LLM will miss than it is to do the same for humans, imho.

LLMs are vulnerable to prompt injection attacks, so I'm not sure they are in advantage.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#343

Post by B1FF_PSUVM »

TeMPOraL wrote: post #282
LeifCarrotson wrote: post #165

Earlier quoted context omitted.

Cost is a parameter subject to engineering tradeoffs, just like performance, feature sets, and implementation time. Security and reliability are also parameters that exist on a sliding scale, the industry has simply chosen to slide the "cost" parameter all the way to one end of the spectrum. As a result, the number of bugs and hacks observed are far enough from the desired value of zero that it's clear the true requi…

> the number of bugs and hacks observed are far enough from the desired value of zero Zero is not the desired number, particularly not when discussing "hacks". This may not matter in current situation, but there's a lot of "security maximalism" in the industry conversations today, and people seem to not realize that dragging the "security" slider all the way to the right means not just the costs becoming practically…

> utility of the product falling down to 0.

Today a bank really sent me a legitimate email about trying their new site. Went over, it was their site alright, logged in with correct username and password - poof, instantly blocked for suspicious access (from my usual home machine), call helpline to fix.

Now that's safe ... and useless. But safe.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#344

Post by HappMacDonald »

xyzzy123 wrote: post #315
LeifCarrotson wrote: post #165

Earlier quoted context omitted.

Cost is a parameter subject to engineering tradeoffs, just like performance, feature sets, and implementation time. Security and reliability are also parameters that exist on a sliding scale, the industry has simply chosen to slide the "cost" parameter all the way to one end of the spectrum. As a result, the number of bugs and hacks observed are far enough from the desired value of zero that it's clear the true requi…

Is it the industry making this choice or the customer? You could make a car that's safer than others at 10x the price but what would the demand look like at that price? Would you pay 2x for your favourite software and forego some of the more complex features to get a version with half the security issues?

Sometimes I want VSCode and sometimes I want Notepad.

Well.. except that I never want either of those. So sometimes I want Kate editor and sometimes I want Akelpad.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#345

Post by koyote »

dnnddidiej wrote: post #161
tmoertel wrote: post #83

Earlier quoted context omitted.

For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond…

Is this a win for .NET where the mothership provides almost all what you need?

Definitely!

The amount of third-party (non-testing related) dependencies needed for most .NET applications is very manageable and the dependencies themselves (generally) don't come with further third-party dependencies (especially now that JSON serialisation is native).

This means that for most applications, the developers know exactly which dependencies are needed (and they are not hidden away in large folder structures either, the dlls are right next to the assembly).

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#346

Post by Eisenstein »

soulofmischief wrote: post #239
amarant wrote: post #95

Earlier quoted context omitted.

Yes, on the one hand, they enable a lot of shady illegal business, but in the other hand, they also destroy the environment while doing it, so it's really a toss up whether cryptocurrency is good or bad overall!

Equating the concept of cryptographic currency with specific implementations such as proof-of-work just shows that you have no idea what you are talking about. The importance of financial sovereignty can not be understated, whether you understand that or not.

What problems are solved by financial sovereignty? How does crypto solve those problems?

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#347

Post by weird-eye-issue »

edg5000 wrote: post #233

> In 2017, a buyer using the alias “Daley Tias” purchased the Display Widgets plugin (200,000 installs) for $15,000 and injected payday loan spam. Is that it? Going through all that trouble just for some spam? Surely more lucrative criminal actions can be imagined with a compromised WP plugin?

You'd be amazed how lucrative this can be.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#348

Post by TeMPOraL »

B1FF_PSUVM wrote: post #343
TeMPOraL wrote: post #282

Earlier quoted context omitted.

> the number of bugs and hacks observed are far enough from the desired value of zero Zero is not the desired number, particularly not when discussing "hacks". This may not matter in current situation, but there's a lot of "security maximalism" in the industry conversations today, and people seem to not realize that dragging the "security" slider all the way to the right means not just the costs becoming practically…

> utility of the product falling down to 0. Today a bank really sent me a legitimate email about trying their new site. Went over, it was their site alright, logged in with correct username and password - poof, instantly blocked for suspicious access (from my usual home machine), call helpline to fix. Now that's safe ... and useless. But safe.

Reminds me of repl.it, which perma-blocked my newly created account before I even had a chance to type in e-mail verification code; in fact the notice about account block came before the one-time e-mail verification code.

I still wonder what did I do wrong (support isn't responsive). But it's true that we're both safe from having a user/vendor relationship now.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#349

Post by lobsterthief »

perlgeek wrote: post #284
KronisLV wrote: post #101

Earlier quoted context omitted.

> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…

I think this discussion distracts a bit from the main point. The main point is that there are super widespread software systems in use that we know aren't secure, and we certainly could do better if we (as the industry, as customers, as vendors) really wanted. A prime example is VPN appliances ("VPN concentrators") to enable remote access to internal company networks. These are pretty much by definition Internet-faci…

But we need to be careful, such strict liability rewards larger companies that can afford such risk. Small companies and freelancers could be left out to dry.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#350

Post by lobsterthief »

neurostimulant wrote: post #278
bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Maybe we should go back to kitchen-sink frameworks so most functionality you need is covered by the fat framework. I'm still using django and it keeps my python project's dependency relatively low :)

And Django is still great!
Post reply on HN