11 ms·
WordPress theme provider Pipdig using customer sites to DDoS competitors
- tfaruq 8y agoFrom pipdig https://www.pipdig.co/blog/sad-times/ https://www.pipdig.co/blog/sad-times/
- ceejayoz 8y agoA pretty sad attempt at turning themselves into the victims, by my reading.
- xvf22 8y agoAgreed, it's a pathetic response that avoids addrssing the obviously malicious behavior. At best it shows incredibly awful development practices.
- navs 8y agoThey seem to be getting some support on Twitter: https://twitter.com/pipdig/status/1112310062956064768 https://twitter.com/pipdig/status/1112310062956064768 It's easy enough these days to blame things on journalists and "fake news".
- duskwuff 8y agoPathetic. If I'm reading this correctly, they're essentially admitting to some of the malicious features described by the researcher, but claiming that they were included for support purposes, or as a way of sabotaging sites using pirated versions of their plugin. 1. Including features which can remotely grant unauthorized access or cause damage to a user's web site is inappropriate under any circumstances. Even if they're your customers, or if they aren't your customers, or whatever. You don't do that. 2. Pipdig hasn't come up with any sensible explanation for why their license checks were pointed at a competitor's web site. It's not even clear why the license check would be architected in a way that allowed for this. 3. Altering user's site content to change links from Blogerize to Pipdig is beyond the pale. Pipdig's explanation of this feature is incoherent; it isn't even consistent with the behavior of the code presented. 4. Obfuscating the code surrounding all of these questionable bits of functionality stinks of wrongdoing. It's understandable for a license check to be a little obfuscated, perhaps, but there's no reason why a remote administration feature should be (even if it had any reason for existing).
- hrrsn 8y agoRe #2, it's clear from reading the code that the function has absolutely nothing to do with a licensing check anyway.
- ohashi 8y agoWe're just a poor small company... that is acts maliciously against our competitors using our code we sell to clients who have no idea! we're sorry we got caught and it's hard to explain why this isn't bad. Oh and they deleted repos apparently, gotta hide the evidence
- pavel_lishin 8y agoDidn't work: https://web.archive.org/web/20190331195338/bitbucket.org/pipdig/p3/commits/edc47824200e15d64cab7270debc4a0526a8d323 https://web.archive.org/web/20190331195338/bitbucket.org/pip...
- jakejarvis 8y agoYikes. "But all my customers love and trust me!" == "I'm just an above-average con man." "But I was just doing this to support them without bothering them!" == "I'm clearly not ready to take responsibility and fess up to anything because I thought my deceptively named functions would fool everybody (and still do)." "But my girlfriend and I love cat memes!" == "Please, for the love of god, can we forget about all this and talk about cat memes instead?" [I honestly have no clue what he was trying to get at in the first six paragraphs...]
- saluki 8y agoIt sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. They were probably obfuscating those functions to hide them from the people selling their themes. Sounds like they were also disabling this plugin as well. But they definitely went about things the wrong way, including functions like that and obfuscating them is definitely not the right way to do things. I think a simple, we're sorry we had included these functions in this manner to combat the company stealing our themes last year. We understand this was wrong and a fresh clean version of the plugin will be out this week. We will do things the right way from now on, you can trust us and we welcome audits of all our code.
- ceejayoz 8y ago> It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. Some of this might be explainable in this fashion, but not all. https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/ https://www.wordfence.com/blog/2019/03/peculiar-php-present-... > Firstly, the plugin includes a content filter that automatically replaces references to Blogerize, a service which claims to be a beginner’s blogging course, with references to Pipdig’s own services.
- cortesoft 8y agoIt sounds like that might have been the place that stole it?
- aiCeivi9 8y agoI am sorry, that we got caught.
- duskwuff 8y agoFollowup at: https://www.jemjabella.co.uk/2019/pipdig-your-questions-answered/ https://www.jemjabella.co.uk/2019/pipdig-your-questions-answ...
- aboutruby 8y agoarchive.org version: https://web.archive.org/web/20190401005430/https://www.jemjabella.co.uk/2019/pipdig-your-questions-answered/ https://web.archive.org/web/20190401005430/https://www.jemja... And original link: https://web.archive.org/web/20190401004514/https://www.jemjabella.co.uk/2019/security-alert-pipdig-insecure-ddosing-competitors/ https://web.archive.org/web/20190401004514/https://www.jemja... I'm getting errors when using a VPN: > The firewall on this server is blocking your connection.
- nickodell 8y agoHere's a second writeup, which also contains a response from pipdig: https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/ https://www.wordfence.com/blog/2019/03/peculiar-php-present-...
- mmaunder 8y agoThanks. My crew put this write-up together. We're here if you have any questions. Jem and us published almost at the same time although I think we beat her by an hour or so. We're in contact. Funny coincidence we were working on the same story at the same time. This has blown up on Twitter. Our team has stayed out of the online debate mostly other than answering questions. We're trying to just focus on the data here. They took their public repo offline, but we mirrored it before they did that. It contradicts some claims they're making re timing. We're publishing a timeline tomorrow and are recording our weekly podcast tonight instead of tomorrow as per normal because of this insanity. We'll break it down on the show. I guess what really jumps out at me here is how they're trying to gaslight the thing.
- mmaunder 8y agoI'd also like to add that the DDoS functionality isn't what really jumped out at me. It was the ability to reset your site's admin password remotely using a hard-coded password that anyone can read. And then there is also the ability to drop all your tables. When we contacted them before publishing via email, they explained that someone had been pirating their software so this was a countermeasure. (quote is in the Wordfence post above) I guess the idea was that they would destroy sites using pirated licenses. Then they backpedalled that later on after this went viral.
- 48309248302 8y ago> I guess the idea was that they would destroy sites using pirated licenses. Isn't it GPL?
- 8y ago
- jarym 8y agoThese guys put all this evil into their code (PHP no less so easily readable by anyone) and it took this long for them to get caught? Further, they peddled this into who knows how many themes they sold and never thought they'd get caught?
- wp381640 8y agotons of wordpress themes and plugin are complete crap - even popular stuff. nobody reads the code or knows how to read it. it makes claiming bug bounties on wordpress sites easy.
- pmlnr 8y agohttps://wordpress.org/plugins/ https://wordpress.org/plugins/ "Extend your WordPress experience with 54,886 plugins." And those are only the ones on wp.org itself; the "premium" themes are in the tens thousands as well. It's not simple to catch these.
- skilled 8y agoDid they seriously have the audacity to deny all this after all those code examples were shown? Edit: Wow, peoples' responses on Twitter are even more delusional. Wtf?
- ceejayoz 8y ago> Wow, peoples' responses on Twitter are even more delusional. Wtf? I find this so baffling. It's like being shown the bodies of a serial killer's victims, and publicly stating "oh, but he never murdered me, so why are you all complaining?"
- creato 8y agoThey surely do not understand they are looking at bodies. They're seeing a bunch of nerd speak about "DDoS" and "dropping database tables" and their eyes glazed over. But they understand their site looks pretty...
- rasz 8y agoA percentage of the population treats something like this as a personal attack. I have Atari/Sega/Chevy thus Commodore/Nintendo/Ford sucks. I use it, why are you saying those things about X, are you calling me stupid? etc.
- auslander 8y agoMisread the name as Pigpig.
- reustle 8y agoA developer at Pipdig wrote these lines of code and shipped it, I wonder how they felt. foreach ($tables as $table) { $wpdb->query("DROP TABLE $table"); }
- Ayesh 8y agoWhile I don't disagree that this is horrible, perhaps the $tables array is hardcoded array.
- dajonker 8y agoIt is not, you can check the post for the full context.
- gadgetoid 8y agoOr, better still, an Archive.org snapshot of the commit that added this very code: https://web.archive.org/web/20190331195338/bitbucket.org/pipdig/p3/commits/edc47824200e15d64cab7270debc4a0526a8d323 https://web.archive.org/web/20190331195338/bitbucket.org/pip... (As a resident geek, I was asked to look into this by a friend)
- aasasd 8y agoFor good measure, the commit seems to be removed from the original repo.
- ivanhoe 8y agoIt's pretty much the same as if it was hardcoded, it drops all tables that have a name starting with the WP prefix. It's extremely ugly, but it's not unsafe (if your plan is removing all WP related tables from the DB).
- corobo 8y agoglobal $wpdb; $prefix = str_replace('_', '\_', $wpdb->prefix); $tables = $wpdb->get_col("SHOW TABLES LIKE '{$prefix}%'"); foreach ($tables as $table) { $wpdb->query("DROP TABLE $table"); } Essentially for those who aren't familiar with WordPress databases - this drops all tables relating to the WordPress install
- nixgeek 8y agoIt looks like the company involved is based in the U.K. and also seems likely this software and their usage of it is a violation of the Computer Misuse Act. One of their competitors should consider filing a complaint with the relevant authorities, so this gets formally investigated.
- gadgetoid 8y agoI would be interested to hear from CloudFlare as to whether there is any possibility of confirming that the URL "https://pipdigz.co.uk/p3/id39dqm3c0_license_h.txt" https://pipdigz.co.uk/p3/id39dqm3c0_license_h.txt" - fetched by the "license check" code - did at some point return the text "https://kotrynabassdesign.com/wp-admin/admin-ajax.php" https://kotrynabassdesign.com/wp-admin/admin-ajax.php". I suspect this will be difficult, or impossible, to verify (I'm not a security expert) and the "license check" code in and of itself (while extremely fishy) only betrays the potential of a DDoS and is not a smoking gun.
- koboll 8y agoYes, absolutely. The responses so far have been too tepid; DDOSing competitors, adding a database-dropping kill switch, disabling other software, and adding an admin login backdoor are all separate criminal offenses. The developer responsible should not just be blacklisted, he should be in prison.
- huxflux 8y ago"Sad times - https://www.pipdig.co/blog/sad-times/" https://www.pipdig.co/blog/sad-times/" No shit.
- 29ssyg 8y agoThis feels like a whole lot of empty, girly drama. The only takeaway from this feud is that you should not trust wordpress themes and plugins even if you pay for them.
- pmlnr 8y ago> Another one from the @pipdig plugin. If you use one of their themes on @bluehost then they intentionally slow your website down by disabling the BlueHost cache plugin, then they can inject content with the title "Is your host slowing you down?" https://twitter.com/nickstadb/status/1112479746972151808 https://twitter.com/nickstadb/status/1112479746972151808 pipdig is a goldmine.
- asadkn 8y agoOn a tangent, let's talk BlueHost. While the call to host switch is malicious, almost every developer in WordPress world will agree BlueHost, and their parent company with all their 50+ hosting companies, are utter garbage. The only reason they exist is because they have hired an army of bloggers and pay them affiliate income of $65 / signup. As far as disabling Endurance Cache goes, it is completely legitimate. It's a plugin forced upon BlueHost users, without being told so, and is a "must-use" plugin that most users will never check (and can't be completely disabled from WordPress admin).
- pmlnr 8y agoWait... so if I write a WP plugin, I'm entitled to disable other plugins I don't like when people install mine? Of course not. That endurance cache is not the only one, there's a list of "plugins we disagree with" which are disabled: https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/#highlighter_107885 https://www.wordfence.com/blog/2019/03/peculiar-php-present-... As for hosting providers: GoDaddy, BlueHost, etc - yes, they're all bad. But that doesn't justify moves like these. Serious question though, on the technical part: WP needs an advanced-cache.php file, which needs to be in wp-content in order for the cache to work; this will list as dropin. Are you sure the endurance cache is MU and not dropin? (Genuine question).
- asadkn 8y agoWhich is why I stated it's a tangent about BlueHost and I definitely don't agree with disabling other plugins. However, I believe it's perfectly valid to disable a forced plugin. If a host forced enabled an almost hidden plugin, without user consent [1], then it's no more evil to undo the evil for the good of users. As for drop-in vs mu, every other cache plugin itself stays a normal plugin so it's not a technical limitation. That's beside the point though, the plugin is force enabled without user consent. [1] https://github.com/bluehost/endurance-page-cache/issues/4#issuecomment-303264966 https://github.com/bluehost/endurance-page-cache/issues/4#is...
- robotbikes 8y agoAnd this just illustrates the horror that is the proprietary market place of WordPress plugins. It is annoying because this results in incentives to take away freedom from users and require payment for proprietary code in the guise of a free software project. To expand Word Press functionality beyond the core functions you have to wade through a minefield of freemium plugins that have all been slightly broken to encourage you to shell out money to someone for code you won't have any freedom with and the worst of it possibly demonstrated by code like this. I have built some sites with WordPress but I have always felt stifled by the way the plugins and themes are distributed. On the other hand I understand people like being able to charge money and create businesses from the code they right which can be more challenging if you actually write free as in libre software vs. attempting to extract money from every potential user.
- pmlnr 8y agoFor my personal site, I've left WP behind about 3 years ago. I had to go back last month, trying to build something instead of a Wix site for a school, and the experience was terrifying: after adding one of the events plugin, within 5 minutes I started getting spam registration. All plugins have ugly admin interface "extras" and are very pushy to buy them. The WordPress of 2007, which I loved very much, has nothing to do with this monster of 2019.
- skilled 8y agoI share a similar sentiment. Since about 2-3 years ago, most WordPress plugins are marketed bloatware that messes up the entire dashboard UI. And don't get me started on plugins that don't let you close their notifications unless you do "some thing". It really is a shame, because frankly speaking - most of these plugins are utter trash anyway.
- pmlnr 8y agoI've tried out a massive amount of gutenberg block plugins; whichever added a new line in the admin menu instead of adding it into a submenu of settings, deserves immediate deletion.
- juiced 8y agoLike always, a story has 2 sides. Do read the response on https://www.pipdig.co/blog/sad-times/ https://www.pipdig.co/blog/sad-times/ carefully too and draw your own conclusions. Having a bit of technical knowledge and understanding what everybody is actually talking about can help with your perspective, else it's hard to come to any well informed conclusion.
- pmlnr 8y agoBeing able to drop someone else's full site contents is not something anyone should get away with under any circumstance. The want to prevent pirated theme - reset the theme to twentysexteen; block frontend access; overlay frontend with notification, etc - so many options. Deleting data? That is not one of them. I won't even get into the deliberate other plugins disabling with comments like "sorry not sorry", including cache plugins to advertise their own hosting. Conclusion: nasty, lying bag of s*.
- juiced 8y agoYou clearly didn't read their response on it.
- pavel_lishin 8y agoI did. It's factually inaccurate. > There was function in an older version of the plugin which could be used to reset a site back to the default settings. This function had no risk of of malicious or unintentional use. > The portrayal of this feature is not based on reality. There is a function in the plugin which can be used to clear database tables, much like a backup or standard reset plugin. To confirm, we do not have the ability to “kill” a site, nor would we ever, ever want to do that! The function is in place to reset a site back to defaults, however it is only activated after being in touch with the site owner. It dropped all wordpress tables. This is not a reset. There's also no reason to only have PipDig able to do this via their server, vs. an option in the configuration. They also don't address the password reset functionality. At best, these people are incompetent and don't realize the power their code wields. At worst, they're just backpedaling and trying to mitigate damage. (I especially like their attempt to humanize themselves by saying they're just four people who like cat memes.)
- fastbeef 8y agoWhat options are left if you need a simple website builder that's not a) Wordpress, which is a swamp filled with mines in the form of plugins b) Wix, which forces hosting and bad HTML on you Basically I want a Wordpress-like frontend + the rich template ecosystem and for it to spit out static HTML files.
- DerekRobot 8y agoNot a web developer, but Grav CMS is pretty neat.
- neurostimulant 8y agoThere are many solutions out there that can generate static sites from a WordPress installation. For example, you can use gatsby.js to generate a static site using WordPress as data source.
- TooCleverByHalf 8y agoJust to clarify for myself, this person asked for alternatives that are not WordPress and Wix and you're recommendation is to use WordPress?
- neurostimulant 8y agoMy point if if you want wordpress ecosystem but don't want the associated risk, there are many ways to generate static websites from a wordpress installation. You can run wordpress locally in your local development computer and only host the generated static html in your server/hosting provider.
- cy6erlion 8y agoThe more I read the more it sounds like an April fools joke.
- EKSolutions 8y agoI'm a little late on the wagon here but someone seems to have made a recent backup of the code on Github: https://github.com/longwave/p3 https://github.com/longwave/p3
- longwave 8y agoThat is me, I found a Dropbox link containing the repo on Twitter and thought it might be a good idea to preserve it.
- EKSolutions 8y agoWell thanks Sir! It seems they've lost their copy of the code history so it's a good job you made a nice backup of it for them.