Slashdot Mirror
WordPress.org Hacked, Plugin Repository Compromised
An anonymous reader writes "Back in April hackers gained access to the WordPress.com servers and exposed passwords/API keys for Twitter and Facebook accounts. Now, hackers gained access to Wordpress.org and the plugin repository. Malicious code was found in several commits including popular plugins such as AddThis, WPtouch, or W3 Total Cache. Matt Mullenweg decided to force-reset all passwords on WordPress.org. This is a great reminder for all users not use the same password for two different services."
and a great reminder as well.
If so, yay!
It's looking increasingly like this year is going to be the year of the hacker. It's a new security breach every week (often several per week). It's getting to be quite dizzying.
Gonna be a tough year for IT security "professionals".
Perhaps someone is just sniffing their email They send all the password plain text! WTF mate?
Get a web developer
Is it too difficult to, instead of storing the actual passwords, store a hash and during authorization just compare the hashes?
"This is a great remainder [sic] for all users not use the same password for two different services."
Not it's not. Not even slightly.
The amount of mental effort required by users to memorise a different password for every internet site is at best unreasonable, if not a completely insane idea. While using the same password for Hotmail and internet banking is really not a good idea, using the same password for wordpress.com and wordpress.org is just common sense for people who don't have a photographic memory.
Blaming the user here is unreasonable.
The summary is incorrect as usual.
Some contributors' accounts were compromised, resulting in updates containing backdoors appearing from those contributors. The blog entry mentions AddThis, WPtouch and W3 Total Cache. The WordPress.org plugin repository was not hacked.
Well, at least you're not racist.
Please say you were joking.
On behalf of the rest of us Americans, please understand that only less than half of the people in our country actually talk and act like this guy; It's not everyone, I assure you.
Loading...
America / American is not a race.
Other than "backdoors", are there any details on what the malicious code in each of the plugins did? A simple back door isn't nearly as worrying if your exposure is limited to the time when you had the compromised plugin running but if the code made other more permanent changes or extracted information that would be a much bigger concern (and leave TONS of people with a huge cleanup effort to re-secure their sites).
...and nothing of value was lost. (Thank you AdBlock Plus for letting me banish that piece of rollover crap.)
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
"Who actually chants "USA! USA! USA!" in America?"
Alabama suicide bombers... Luckily they build the bombs themselves and end up exploding prematurely in a open field.
Do not look at laser with remaining good eye.
I didn't say it was.
there is WAY too many hacking going on. and for some twist of fate, this just predates the pending internet censorship/control scheme vote in american senate. and, american sources are attacked. way too many 'coincidence'.
either this is some shady operation, or there is no course called 'statistics' on this planet.
Read radical news here
They can be considered to be.
race2
[reys] Show IPA
–noun
1. a group of persons related by common descent or heredity.
2. a population so related.
3. Anthropology .
a. any of the traditional divisions of humankind, the commonest being the Caucasian, Mongoloid, and Negro, characterized by supposedly distinctive and universal physical characteristics: no longer in technical use.
b. an arbitrary classification of modern humans, sometimes, especially formerly, based on any or a combination of various physical characteristics, as skin color, facial form, or eye shape, and now frequently based on such genetic markers as blood groups.
c. a human population partially isolated reproductively from other populations, whose members share a greater degree of physical and genetic similarity with one another than with other humans.
4. a group of tribes or peoples forming an ethnic stock: the Slavic race.
5. any people united by common history, language, cultural traits, etc.: the Dutch race.
This is a great remainder for all users not use the same password for two different services.
And how is this going to result in a hacked website? Breaking into a user account should not give you administrator privileges. No, this is a great reminder to secure your fucking website against SQL injection, once again. Never trust your users just because they are "logged in". Now of course if the administrator of the website was using the same login/password as his gmail account or something then yes, he should be shot.
Seven puppies were harmed during the making of this post.
Who actually chants "USA! USA! USA!" in America?
I worked with the wealthy snowbirds and the every day racism of Americans drove me back to Germany. Genuine hate towards foreigners from people who's great grand parents stole the land they live on today.
All in the name of freedom, progress and the good old US of A, fuck that, fuck them.
Oh my. A German chiding the people of other nations over hate. That's absolutely hilarious. I needed that laugh today.
Well, Philly is backwards - but it's not Southern.
http://www.myfoxphilly.com/dpp/sports/mlb/phillies/Osama_Bin_Laden_Dead_Citizens_Bank_Park_USA_Chants_050111
I think this may explain why, when I updated AddThis on some of my sites, it caused the white screen of death instead. So far the sites look ok, but now I need to go over them in more detail.
Earlier today the WordPress team noticed suspicious commits to several popular plugins (AddThis, WPtouch, and W3 Total Cache) containing cleverly disguised backdoors. We determined the commits were not from the authors, rolled them back
Three popular plugins. Yes, they're popular, I've used all three on several sites.
THAT'S IT! That is the extent of the damage. Three plugin authors whose passwords were exposed. Nobody "gained access to [...] the plugin repository". Dear submitter, go back to kindergarten and learn to read. It's in the first two goddamned sentences.
This place has gone to the dogs... where the hell is a guy supposed to get his tech news anymore ?
-Billco, Fnarg.com
For 50-60% of the wordpress users are just that, normal people with a blog or a small business. Leave them alone your just hurting little people.
Apparently you've never heard of Hacksaw Jim Duggan....
*plays the Apogee theme song music*
I didn't say you did.
Oh my. A German chiding the people of other nations over hate. That's absolutely hilarious. I needed that laugh today.
Perhaps he feels qualified to comment; the Germans having had much experience in such matters.
Look at the footage just after Osama Bin Laden was killed. There seemed to be no shortage of people doing exactly that.
Yeah, this _is_ a great reminder. Just use KeePassX (http://www.keepassx.org/) or something similar...
I can't recommend this product highly enough. I've used Keep Ass X on my website for years, and I would certainly say it lived up to its promise of covering my ass!
Bow-ties are cool.
Cool. Glad we're on the same page.
"people who's great grand parents stole the land they live on today."
You obviously have no concept of historic reality. Everyone stole the land they're on unless they bought it. In the past buying was rare. Instead people invaded, conquored, killed, raped, intermarried, enslaved and merged in time. It was the way. Stop being such a nationalist bigot.
Who actually chants "USA! USA! USA!" in America? Is that a southern thing, ...
Apparently you missed the coverage of Times Square the day Bin Laden was killed. There was no shortage of New York City residents chanting for the TV cameras.
As someone that's done a lot of end-user work, it annoys me to see the level of arrogance coming from posts like this one where the idea of using multiple passwords for different services is touted as the Only Responsible Way to do anything online.
It doesn't bother me because it's a bad idea, it bothers me because if it's so goddamned important - why haven't the companies that make our web browsers and operating systems put some fucking effort into building features for this into our infrastructure? I have accounts on dozens, if not _hundreds_ of sites, and the best I can manage for passwords is having a stable of a few passwords of increasing complexity dependent on how secure the site in question is. If it accesses my money in any way, it gets high-security. If it doesn't, it gets mid-security, if it's a hobbyist or community-run website it gets low security. On occasions, I need to change my low security password (such as the Gawker hit) but that's part of the game. When I needed to change it however, I needed to change it on dozens of websites.
Would a password management system be a good idea? Hell yes. Is it the best way to manage things? Sure, _as long as the repository is safe_. My problem with the arrogance noted above is due to the fact some people somehow magically expect normal users to do something that trained, knowledgeable IT people frequently consider too much of a pain in the ass to bother with.
If this is truly an important problem that needs to be tackled (protip: It is) then let's get some industry muscle put to work here. Get the HTML standard to include a password management and transmission feature, something robust enough to handle the hundreds of sites people may actually visit. Build the OSX Keychain into my web browser, instead of having to set up plugins like KeePass to do a job the browser should already be handling. Fucking do _something_ to improve this situation, on a wide-scale infrastructure level. It's not impossible. It just takes the right people to get it done.
My own pointless vanity vintage computing page
Comment removed based on user account deletion
This is a great remainder for all users not use the same password for two different services.
Not really. I divide my logins into two categories: stuff that, if it were all compromised simultaneously, would be inconvenient but otherwise no big deal; and everything else. In the "everything else" category, every password is unique. For the stuff that isn't life or lifestyle critical, I save myself some mental effort and just use the same password.
Oh noes, they got my Slashdot account, my account on some news website where I logged in once to respond to an idiotic comment, and my account on the website where everybody talks about frogs. I'm sooo scared. Seriously, the risk of it happening is pretty low (not the initial compromise, but the risk that they will go on to compromise ALL of my other accounts before I have a chance to react), and it certainly isn't worth the inconvenience of zillions of passwords on sites that aren't that important in the grand scheme of things.
Bank account logins, stock brokerage logins, passwords to my hosting provider and DNS registrar logins, etc., that stuff is all unique, and memorized, so it's not even written down anywhere even in encrypted form.
Hackers become the security professionals and vice versa. They are some of the highest paid people in the computer world. And yes you should have a different randomly generated password for everything. Put it in a text file on your computer in a secure disk image or some similar depending on your os. Additionally people who make these systems should not be storing passwords plaintext. The least you could do is store message digests of passwords.
"Who actually chants "USA! USA! USA!" in America?"
Northern "conservatives", of the nationalistic jingoist variety.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
It'll happen when they get "hit" hard enough. It's like insurances I suppose. Nothing inspires any entity like that, the experience of being burnt or hurt by anything.
Sure - Fear's easy enough to sell, but protection vs. bad experiences? Even easier.
In a "StRaNgE" way, perhaps the boys from LuLzSec &/or Anonymous (plus the harder-core hacker/cracker types out there too) in their own weird way, are making some good come out of their bad.
It was much the same with computer viruses/malware really. Nobody did anything about them, until they got "NOOKED" by one. Same here too "back in the day" for me in DOS (McAfee was KING then & I bought into them).
It'll happen man, & some good comes out of the bad. Things do have a way of working out.
This, in turn, hopefully should be good for job creation in the IT field!
(Which job creation, not shit jobs, but well paying ones, & spurring them? That should be #1 on the US Gov't.'s agenda imo, more than anything, to save us economically really - give folks disposable extra income, they'll spend it... which in turn, allows Peter Business to pay his supplier Paul Business, & the economic engine's wheels start turning).
* Let's hope this all works out that way, right?
APK
P.S.=> Personally, I do think that the government's trying to do their part, based on the information from this site a this past week, & this may interest you IF you missed it here the other day:
---
Cybersecurity and the Internet Economy:
http://yro.slashdot.org/comments.pl?sid=2222868&cid=36379698
(I said much the same as you have here in fact there)
and
Feds Recruiting ISPs To Combat Cyber Threats:
http://yro.slashdot.org/comments.pl?sid=2250682&cid=36495130
---
Personally, I do *think* our politicians are trying, but... their hands get tied.
IMO @ least? "Big Money" REALLY "runs the show" out there, not our politicians.
( & the reason they HAVE big money is, they hold onto it, tightly... )
Plus, typically as I am certain you guys know, spending on SERIOUS security costs, so they omit that cost until they absolutely HAVE to implement it, seriously.
Small businesses perhaps aren't fully aware of it, they're in business & expert @ what THEY do, not computing too, so... there you are!
(At least from my perspective + experiences in the computing field since 1994 professionally @ least, such as it is (where I've seen & heard that "train-of-thought" before on the job over time the past decade a couple times in fact, @ diff. companies))
Hey - it's just the way it works I have found @ least, most times!
... apk
I have read over 100 virtually useless comments on the events that transpired at Wordpress, yet not one individual, not even the nefarious "Anonymous Coward" has come forward and blamed Microsoft for this dastardly deed. This had led me to the only logical conclusion, a cold day in Hell has finally arrived.
Pigskin-Referee
Linux: Yesterday's technology, tomorrow
Hi,
i've wrote a usefull wordpress plugin. Hash links and generate pages to bring up your blogs popularity in search engines.
Vist my blog: Devcon
Try it out!
Greetings