5 ms·

It's a known hard problem. Capability based permissions vs access control based permissions. I would trust wordpress to keep their signing keys safe. https://e

It's a known hard problem. Capability based permissions vs access control based permissions. I would trust wordpress to keep their signing keys safe. https://en.m.wikipedia.org/wiki/Confused_deputy_problem https://en.m.wikipedia.org/wiki/Confused_deputy_problem

stephenr 9y ago
It’s nothing to do with signing keys. If php has permission to extract an archive with new files over the current ones, it has permission to write a malicious file over a current one. I’m not talking about a vulnerability on the wordpress central infra that delivers a malicious update via the legitimate update path. I’m talking about a vulnerability in the millions of wordpress installs that have filesystem permissions to overwrite themselves, to facilitate “auto update”.
- mgkimsal 9y ago
  This is almost always at the core of WP exploits. Sure, there have been some SQL injection and XSS, but almost every WP exploit I've seen in person has been related to files being able to be written to the filesystem and become a publicly accessible URL immediately. I don't do as much with WP these days, but have worked with it some over the years, and work with multiple folks in the geographic area who primarily do WP work (friends with folks who run WP meetings and do all-WP work, etc). I've seen dozens of exploited systems in the last 2-3 years, and been asked to help 'clean them up'. Every single one of those was some variation on some bot exploiting some code (in core or in a plugin) that allowed for some obfuscated code to be written to a publicly accessible directory, with names like "includes.php" or "sys.php" (things like that) - common words that no one who is not a WP expert would even think to question in the first place (no one leaves BACKDOOR_EXPLOIT.php as a file name, for example). Yes, you can install stuff like wordfence and similar tools to continually scan your disk to look for 'infections', but... why allow those to be written to the drive in the first place? I know the answer is "convenience", but it's been a huge community price to pay.
regecks 9y ago
Can't reply to stephenr because comment thread is too deep, but it's perfectly possible to run WordPress without write permissions anywhere near executable code and then to schedule automatic updates at a different privilege level. Since this is done extremely rarely, that leads me to believe that its more of a cultural problem (perhaps with the WordPress team, even) than a technical one. Spent 5 years in shared PHP web hosting, can confirm that most of the people are muddling through with the bare minimum of understanding to get WordPress going.
- stephenr 9y ago
  > schedule automatic updates at a different privilege level That is inherently not the default for wordpress, and at that point you may as well be installing via deb/rpm. I didn’t say scheduled updated are bad I said a self writable web app is a fucking security nightmare.
- reificator 9y ago
  > Can't reply to stephenr because comment thread is too deep I've found that clicking a comment's timestamp to view a permalink to it will usually allow replying.
temprature 9y ago
> I would trust wordpress to keep their signing keys safe. What signing keys? Wordpress's automatic updates aren't signed, so your trust is horrendously misplaced. Someone already did the work for them to implement it[0], and rather than commit it, a Wordpress developer wrote a blogpost saying signing isn't really that important[1]. [0] https://core.trac.wordpress.org/ticket/39309 https://core.trac.wordpress.org/ticket/39309 [1] https://medium.com/@photomatt/wordpress-and-update-signing-51501213e1 https://medium.com/@photomatt/wordpress-and-update-signing-5...

stephenr 9y ago

It’s nothing to do with signing keys. If php has permission to extract an archive with new files over the current ones, it has permission to write a malicious file over a current one. I’m not talking about a vulnerability on the wordpress central infra that delivers a malicious update via the legitimate update path. I’m talking about a vulnerability in the millions of wordpress installs that have filesystem permissions to overwrite themselves, to facilitate “auto update”.

mgkimsal 9y ago
This is almost always at the core of WP exploits. Sure, there have been some SQL injection and XSS, but almost every WP exploit I've seen in person has been related to files being able to be written to the filesystem and become a publicly accessible URL immediately. I don't do as much with WP these days, but have worked with it some over the years, and work with multiple folks in the geographic area who primarily do WP work (friends with folks who run WP meetings and do all-WP work, etc). I've seen dozens of exploited systems in the last 2-3 years, and been asked to help 'clean them up'. Every single one of those was some variation on some bot exploiting some code (in core or in a plugin) that allowed for some obfuscated code to be written to a publicly accessible directory, with names like "includes.php" or "sys.php" (things like that) - common words that no one who is not a WP expert would even think to question in the first place (no one leaves BACKDOOR_EXPLOIT.php as a file name, for example). Yes, you can install stuff like wordfence and similar tools to continually scan your disk to look for 'infections', but... why allow those to be written to the drive in the first place? I know the answer is "convenience", but it's been a huge community price to pay.

regecks 9y ago

Can't reply to stephenr because comment thread is too deep, but it's perfectly possible to run WordPress without write permissions anywhere near executable code and then to schedule automatic updates at a different privilege level. Since this is done extremely rarely, that leads me to believe that its more of a cultural problem (perhaps with the WordPress team, even) than a technical one. Spent 5 years in shared PHP web hosting, can confirm that most of the people are muddling through with the bare minimum of understanding to get WordPress going.

stephenr 9y ago
> schedule automatic updates at a different privilege level That is inherently not the default for wordpress, and at that point you may as well be installing via deb/rpm. I didn’t say scheduled updated are bad I said a self writable web app is a fucking security nightmare.
reificator 9y ago
> Can't reply to stephenr because comment thread is too deep I've found that clicking a comment's timestamp to view a permalink to it will usually allow replying.

temprature 9y ago

> I would trust wordpress to keep their signing keys safe. What signing keys? Wordpress's automatic updates aren't signed, so your trust is horrendously misplaced. Someone already did the work for them to implement it[0], and rather than commit it, a Wordpress developer wrote a blogpost saying signing isn't really that important[1]. [0] https://core.trac.wordpress.org/ticket/39309 https://core.trac.wordpress.org/ticket/39309 [1] https://medium.com/@photomatt/wordpress-and-update-signing-51501213e1 https://medium.com/@photomatt/wordpress-and-update-signing-5...