6 ms·

I have a Wordpress plugin with ~100k active installs. Recently I've started getting emails from people wanting to buy the plugin from me. I'm assuming they wa

I have a Wordpress plugin with ~100k active installs. Recently I've started getting emails from people wanting to buy the plugin from me. I'm assuming they want it for a botnet or other nefarious purposes. I'm not sure if Wordpress have stepped up their monitoring of plugins or not, but in past there was little oversight of the plugins and adding a direct backdoor to those 100k servers would be trivial, not to mention the millions of people that could be reached via JavaScript injection.

Sujan 11y ago
May I ask how much they are offering?
- joshfraser 11y ago
  $150.00 USD for every 1,000 installs.
  - Sujan 11y ago
    Wow, that's a lot of money. Thanks for not taking it. (You didn't, right?) Btw: still wearing my Torbit shirt sometimes ;)
    - joshfraser 11y ago
      No, I didn't take it. Saving it for my own botnet. ;) And awesome! Really happy to hear you're still enjoying your Torbit shirt.
  - jakejake 11y ago
    That's a surprising amount. I'd imagine if its spammers or something, I would be highly suspicious of their payment being legit (stolen PayPal account or something). I have almost 500k plugin installs, I'd sell my plugin for that amount if I knew it was going to a legit company!
lucaspiller 11y ago
Over the summer I tried taking over a few abandoned Wordpress plugins, some of which had a similar number of installs. Before they would even try to get in touch with the authors they wanted to see my updated code and made sure it was up to current Wordpress standards. Once you have access to the plugin repo you are free to push whatever you want though without review...
- Otto42 11y ago
  "Without review" is not quite true. Some of us get an email for every commit. Not kidding. Helps a lot for the scanning of things.
  - lucaspiller 11y ago
    I meant more that code can be pushed to the repository without it being reviewed first, not that nobody is looking at it. If someone does push something bad are there systems in place to blacklist a plugin and remotely remove it from an install (and possibly contact the install owners)?
    - Otto42 11y ago
      > are there systems in place to blacklist a plugin and remotely remove it from an install (and possibly contact the install owners) We have automated scanning systems for suspicious code commits. If they occur, me and a few others get an email for manual review of the problem. Additionally, many others get every commit and set up their own scanning tools to see what's happening, as it happens. When something-bad™ happens, then we can close a plugin (block it from being downloaded or found in searches), revert changes or otherwise manually adjust any aspect of the plugin, and if necessary, push updates for it to any WordPress installs that have it. Realistically, bad actors are not generally a problem for the plugins system. I can count on one hand the number of times this has occurred to the point where we'd need to actually push code. The real problem we're fighting is accidental security issues. While WordPress core is quite secure, plugins have much less eyes on the problem, and a lot of plugin developers are relatively new coders. Things like simple SQL injections still pop up from time to time in plugins, and that's a big problem. So, the security issues with with plugins repository is not really about some malicious person out there. Malicious people tend to be dumb spammers. They're easy to spot and protect against, because they're only after the low hanging fruit. What we mostly try to find are the things that good coding practices would protect against, because not everybody uses good coding practices. Those tend to be harder to scan for on an automatic basis.
Otto42 11y ago
We do monitor that sort of thing. Very closely. Oh, and I got that email too. They didn't really vet that email list very well, or they would have been smarter about it. :)
yAnonymous 11y ago
Did you consider taking the money and refusing them access? Beat them at their own game.
- Sujan 11y ago
  Stealing from ganster is almost never a good idea...

Sujan 11y ago

May I ask how much they are offering?

joshfraser 11y ago
$150.00 USD for every 1,000 installs.
- Sujan 11y ago
  Wow, that's a lot of money. Thanks for not taking it. (You didn't, right?) Btw: still wearing my Torbit shirt sometimes ;)
  - joshfraser 11y ago
    No, I didn't take it. Saving it for my own botnet. ;) And awesome! Really happy to hear you're still enjoying your Torbit shirt.
- jakejake 11y ago
  That's a surprising amount. I'd imagine if its spammers or something, I would be highly suspicious of their payment being legit (stolen PayPal account or something). I have almost 500k plugin installs, I'd sell my plugin for that amount if I knew it was going to a legit company!

lucaspiller 11y ago

Over the summer I tried taking over a few abandoned Wordpress plugins, some of which had a similar number of installs. Before they would even try to get in touch with the authors they wanted to see my updated code and made sure it was up to current Wordpress standards. Once you have access to the plugin repo you are free to push whatever you want though without review...

Otto42 11y ago
"Without review" is not quite true. Some of us get an email for every commit. Not kidding. Helps a lot for the scanning of things.
- lucaspiller 11y ago
  I meant more that code can be pushed to the repository without it being reviewed first, not that nobody is looking at it. If someone does push something bad are there systems in place to blacklist a plugin and remotely remove it from an install (and possibly contact the install owners)?
  - Otto42 11y ago
    > are there systems in place to blacklist a plugin and remotely remove it from an install (and possibly contact the install owners) We have automated scanning systems for suspicious code commits. If they occur, me and a few others get an email for manual review of the problem. Additionally, many others get every commit and set up their own scanning tools to see what's happening, as it happens. When something-bad™ happens, then we can close a plugin (block it from being downloaded or found in searches), revert changes or otherwise manually adjust any aspect of the plugin, and if necessary, push updates for it to any WordPress installs that have it. Realistically, bad actors are not generally a problem for the plugins system. I can count on one hand the number of times this has occurred to the point where we'd need to actually push code. The real problem we're fighting is accidental security issues. While WordPress core is quite secure, plugins have much less eyes on the problem, and a lot of plugin developers are relatively new coders. Things like simple SQL injections still pop up from time to time in plugins, and that's a big problem. So, the security issues with with plugins repository is not really about some malicious person out there. Malicious people tend to be dumb spammers. They're easy to spot and protect against, because they're only after the low hanging fruit. What we mostly try to find are the things that good coding practices would protect against, because not everybody uses good coding practices. Those tend to be harder to scan for on an automatic basis.

Otto42 11y ago

We do monitor that sort of thing. Very closely. Oh, and I got that email too. They didn't really vet that email list very well, or they would have been smarter about it. :)

yAnonymous 11y ago

Did you consider taking the money and refusing them access? Beat them at their own game.

Sujan 11y ago
Stealing from ganster is almost never a good idea...