[flagged]
I think you're behind the times, you need to replace "crypto" with "AI" now.
Someone bought 30 WordPress plugins and planted a backdoor in all of them
71–80 of 368 posts
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#72Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
Rust is like this too. Every time I open a Rust project I look at Cargo.lock and see hundreds of recursive dependencies. Compared to traditional C or C++ projects it's madness.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#73[flagged]
> I used to think that HN is full of enlightened open minded people who are open to correcting misconceptions if presented with new evidence, and adopting better practices.
Well, I don't think the average HNer has much of a say in how WordPress is operated, or even uses WordPress by preference.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#74This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
> And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake". LAPSUS$ was prolific by just bribing employees with admin access. This is far from theoretical. Just imagine the kind of money your average nation state has laying around to bribe someone with internal access.
> they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake".
Orthogonal, but in similar spirits: the FAANG part of big tech paying less, doing massive layoffs, and putting enormous pressure on their remaining engineers might have this effect too in a less directly malicious way.
Big tech does layoffs, asks engineers to do "more". This creates a lot of mess, tech debt, difficult to maintain or SRE services. Difficult to migrate and undo, difficult to be nimble.
These same engineers can then leave for startups or more nimble pastures and eat the cake of the large enterprise struggling to KTLO or steer the ship of the given product area.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#75I really wish that the FAIR package manager project had been successful, but they recently gave up after the WordPress drama died down. https://fair.pm/ FAIR has a very interesting architecture, inspired by atproto, that I think has the potential to mitigate some of the supply-chain attacks we've seen recently. In FAIR, there's no central package repository. Anyone can run one, like an atproto PDS. Packages have DIDs…
Assuming that the majority of repositories will be malware with SEO hooks, how would one locate a safe directory using only a search engine (as opposed to whispered tips from coworkers, etc)? I don’t see how proliferation of repositories improves things for users. (Certainly, it does serve up the usual freedom-from-regulation dreams on a silver platter, but that’s value-neutral from a usability perspective.)
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#76This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
> but they don't need FreeBSD exploit-writing capabilities for that. That's a solid point. There was a piece the other day in the Register [1] that studying supply chains for cost-benefit-risk analysis is how some of them increasingly operate. And, well, why wouldn't they if they're rational (an assumption that is debatable, of course)? [1] https://www.theregister.com/2026/04/11/trivy_axios_supply_ch...
>if they're rational (an assumption that is debatable, of course)
Feels like crime is an almost perfect simulation of the free market: almost/ all of the non-rational actors will be crowded out by evolutionary pressure to be better at finding the highest expected values, where EV would be something like [difficulty to break in] x [best-guess value of access].
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#77This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
That there is a preexisting way for people to get hacked doesn't seem to be a reason to dismiss other, new ways for people to get hacked.
First, I'm not dismissing anything. I'm just saying it's not the most significant concern. Second, Mythos doesn't create "new ways". You already have plenty of vulns to go after, and you can write exploits for them (or pay someone). It just lowers the cost / commoditizes the toolkit. It's not the first time it has happened - the trend goes all the way back to Metasploit or before.
And again, I'm not saying it doesn't matter. All I said is that it's probably not the #1 thing to lose sleep over.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#78Earlier quoted context omitted.
Frontend: eh - you could pick something that targets wasm. Definitely a tradeoff with its own headaches.
Rust wasm ecosystem also needs a lot of crates to do anything useful, a lot of them unmaintained.
Now I imagining it like being outside a concert or other ticketed event: "Crates, who's selling? Who's buying?"
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#79This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
Well, Cryptocurrencies are part of said new era. They aren't strictly a problem that made things worse: they're a technology that comes with tradeoffs. The cat is out of the bag and we have to design around technologies that are here to stay in whatever capacity. Distributed, cryptography-based currencies/tokens are one of those technologies.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#80I really wish that the FAIR package manager project had been successful, but they recently gave up after the WordPress drama died down. https://fair.pm/ FAIR has a very interesting architecture, inspired by atproto, that I think has the potential to mitigate some of the supply-chain attacks we've seen recently. In FAIR, there's no central package repository. Anyone can run one, like an atproto PDS. Packages have DIDs…
We didn’t give up! We’ve pivoted efforts - focussing more on the technical part of the project, and expanding into other ecosystems. We’re currently working with the Typo3 community to bring FAIR there, as well as expanding further.
(AMA, I’m a co-chair and wrote much of the core protocol.)