Slashdot Mirror
WordPress Plugin Comes With a Backdoor, Steals Admin Credentials In Cleartext
An anonymous reader writes that a WordPress plugin for managing custom post types has apparently been forcibly taken over by an Indian developer who has added a backdoor to the code which lets him install files on infected sites. "This backdoor also allows him to download files which add his own admin account to the site, and even alter core WordPress files so every time a user logs in, edits his profile, or a new user account is created, the user's password is collected (in cleartext) and sent to his server. WordPress hasn't moved in to ban the plugin just yet, despite user complaints.
I find the info quite aggressive agains WP, the plugin indeed has been banned, and before this second post...
Herve S.
I see no good reason that the plugin hasn't been banned. It's behaving in a completely unreasonable manner when it's sending passwords to the "developer." There's also no good reason to allow such a takeover. Forking a plugin makes sense, sure, but not a takeover like this.
It also seems certain that these passwords are being abused, and the developer would appear to be a likely suspect. The developer should be extradited to face charges for this. It's malicious; there's certainly no legitimate reason to send passwords to the developer.
This is ludicrous. Can you define what constitute "forciblity"?
Seriously guys, I know it's the quick and lazy way to put together a website but it's obvious that this sort of thing is going to happen in that creaking pile of php intentional or otherwise.
Security issues with WordPress? What is this world coming to?
"So... it takes an hour to be compromised?" he asks, using a word he must have recently heard at an IT Manager's round table somewhere.
"No, it takes about 30 seconds to compromise, but on average it takes about an hour for the robots to find it." I reply.
Have people forgotten what it means to run a program? It seems that script languages, sandbox runtime environments and checked code have numbed people to the realities of running code from the internet.
I RTFA an apparently it's just a bug in the Plugins auto-update. Albeight a WP bug, that has the potential to bring down the entire site and/or expose the sites core. But we're talking about WP, so no big surprise here.
Important rule for WP: Avoid plugins where possible, they're often even worse than legacy WP code itself.
We suffer more in our imagination than in reality. - Seneca
So somebody did the needful?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I find the info quite aggressive agains WP, the plugin indeed has been banned, and before this second post...
So; wordpress reacts to bad publicity not to threats to their users. That's actually worse than if they did nothing because if they did nothing we'd hear about it all the time whereas now the questions are, "What else did Wordpress manage to close down just before it got written about on Slashdot? What else is Wordpress hiding?"
Somewhere there are wordpress users who have installed this and either have not yet had their credentials stolen or have not yet had them used against them. Notifying their users should be the top priority. This should be front page on their site. This should be the top news on their blog. There is nothing there. Wordpress is still hiding things and letting down their users. This posting is not nearly aggressive enough.
Because they would mop up these Indians and be done with them before you can say Geronimo!
we haven't needed SEO in years. why do these asshats still exist? all they do is perpetuate spam, and con website owners out of their cash.
I find the info quite aggressive agains WP, the plugin indeed has been banned, and before this second post...
There is typically a delay between submitting a story to Slashdot and it actually being posted. This delay can account for changing facts in a case that is unfolding as the reporting on it progresses.
What we need is more rigour on posting updates to stories where the facts change while the story is still fresh.
So, you're saying they don't need the BadPress(tm)?
I find the info quite aggressive agains WP, the plugin indeed has been banned, and before this second post...
So; wordpress reacts to bad publicity not to threats to their users. That's actually worse than if they did nothing because if they did nothing we'd hear about it all the time whereas now the questions are, "What else did Wordpress manage to close down just before it got written about on Slashdot? What else is Wordpress hiding?"
Somewhere there are wordpress users who have installed this and either have not yet had their credentials stolen or have not yet had them used against them. Notifying their users should be the top priority. This should be front page on their site. This should be the top news on their blog. There is nothing there. Wordpress is still hiding things and letting down their users. This posting is not nearly aggressive enough.
Wordpress.com is very different than the community wordpress.org, one is a commercial entity that offers free and paid hosted wordpress services and the latter is the upstream/open source wordpress community that offers wordpress for self-hosting.
Neither of these entities are responsible for or have any control over 3rd party plugins like the one mentioned in the article. This would be like blaming Microsoft for someone releasing Win32 shareware that hijacked credentials.
Have a squat over at the hobo house.
You mean stopped using wordpress ?
Microsoft gets blamed for security holes all the time, and these are exploited by 3rd parties. Your last point makes no sense.
Seven puppies were harmed during the making of this post.
The malware plugin sends login credentials of any user to a server run by the "developer." That has the potential to compromise a very large number of usernames and passwords. Because many users frequently reuse passwords, that has the potential to compromise accounts across a wide variety of services. There's a lot of damage that can be inflicted on unsuspecting users. Preventing the plugin from being distributed doesn't clean up the damage from existing installations. Normally I despise DDoS attacks because they're an offensive measure. However, in this case, a DDoS against the developer's server could actually mitigate more damage than it causes. There's no other easy way to take down the server without the assistance of law enforcement or whoever is hosting the server. It seems like a DDoS attack might actually be an ethical action to prevent more people from having their credentials compromised. Ideally, someone could compromise the developer's server and delete whatever data had been harvested. But it seems like a DDoS might actually be a more practical approach for mitigation. Can a DDoS be justified in any situation? I've always considered a DDoS attack unjustifiable, but in a situation like this, can such an attack be justified?
I believe somebody just rebooted the server.
-SR
Your post doesn't make sense! Observe that we aren't talking about a bug or backdoor in a MS product, just that software that uses the public API to do something. So do you really blame MS when someone downloads something that can run on a Windows machine and it happens to be malware?
If so I hope you blame Linus whenever someone installs some malware on their Linux machine...
Where is the pride that people use to have? At least use encryption to send the passwords back to your site! I mean, what's the point of gathering all of those passwords if you are going to send them plain text for all of the world to see. Probably sent them directly to the final site too instead of round about way that's hard to trace.
What's GD name OTF plug in?
Is that because WP is fast or Slashdot is slow?
So I was writing a blog post on Wordpress
And suddenly, it's like, "BEEP BEEP BEEP" and then, like, half my blog post was gone.
And I was like, "huh?"
It devoured my blog post. It was a really good blog post.
And then I had to write it again, and I had to do it fast so it wasn't as good.
It's kind of... a bummer.
I t depends. Does Microsoft make the theoretical program available through Windows Store?
So business as usual.
Users? Fuck them, they don't pay.
And suddenly, it's like, "BEEP BEEP BEEP" and then, like, half my blog post was gone.
You should have composed your blog post in a separate text file, copy and paste into WordPress editor, and finalized the blog post.
I find the info quite aggressive agains WP, the plugin indeed has been banned, and before this second post...
WP deserve all the criticism they get. Publishing a plugin architecture so open to privilege escalation should be illegal. They claim to be secure against common attacks. Yet privilege escalation via plugin doesn't count?
From the Wordpress web site.. "Since its inception in 2003, WordPress has undergone continual hardening so its core software can address and mitigate common security threats, including the Top 10 list identified by The Open Web Application Security Project (OWASP) as common security vulnerabilities, which are discussed in this document."
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
You should have composed your blog post in a separate text file, copy and paste into WordPress editor, and finalized the blog post.
Whoosh!
Enlightenment: https://www.youtube.com/watch?...
Just cruising through this digital world at 33 1/3 rpm...
What we need is more rigour on posting updates to stories where the facts change while the story is still fresh.
Like how The New York Times kept changing the content of an exclusive story on its website?
http://www.poynter.org/2015/new-york-times-changes-its-hillary-clinton-story-again/360545/
Whoosh!
I'm using a PC. That's why I gave my advice. ;)
Doesn't it?
I read that not once, but twice, as "I'm used to being PC." I guffawed.
"So long and thanks for all the fish."
Even if they had, you'd still find a reason to piss your knickers and whinge.
Like how The New York Times kept changing the content of an exclusive story on its website?
Yes. Exactly like that.
> Publishing a plugin architecture so open to privilege escalation should be illegal.
Really? Illegal? Really?
"So long and thanks for all the fish."
wordpress.org is hosting this plugin
I read that not once, but twice, as "I'm used to being PC." I guffawed.
I want to be a Mac. But my insurance doesn't cover those kinds of computational operations.
Only a ban on the plugin? No prosecution? He committed a serious felony against thousands of people. So the government does nothing about it? Yeah, because they only shit their pants when someone tries to hack into their systems. To hell with the public.
Anyone who writes PHP or uses PHP software needs to be shot into the sun.
It would solve so many of the worlds problems.
Our longstanding policy: PHP on your resume? Into the shredder it goes after it gets passed around and laughed at. Even the janitor gets a good laugh from it.
Like how The New York Times kept changing the content of an exclusive story on its website?
NO! Not at all. Not even in the slightest. I never said "change the content". I said "Posting Updates".
I.e. if I had an edit button above I would write:
Update 06/03/16: It seems most Slashdot posters think everything is some nefarious conspiracy.
> Publishing a plugin architecture so open to privilege escalation should be illegal.
Really? Illegal? Really?
Yes. When you also make claims that your software is secure.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Another victim of outsourcing turns to bitter racism for comfort.
Actually, as soon as we were notified of the issue, the plugin was closed and hidden on a temporary basis until we had time to evaluate the problem. Once we had done so, I personally created a new version of the plugin, without the malicious code, and pushed it to the repository in order to get the update out to the affected users. The existing committers were all removed, leaving the plugin entirely in the hands of the plugin team. The latest version is now safe and will not be otherwise until we determine the full details of what happened here.
Full disclosure is great, but some advance notice longer than a day or so helps a lot. We will always protect our users to the best of our ability, but sometimes, we get blind sided. It happens. Nobody posts about the dozens of other times we fix things before they get exploited. Not judging, just saying.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.