15 ms·
WordPress themes, plugins backdoored in supply chain attack
- throwthere 5y agoI’m not in this space anymore but 15 years ago backdoored wp themes was par for the course. Interesting to see how things have changed.
- jacquesm 5y agoMore interesting to see how they didn't!
- tannhaeuser 5y agoPlugin and theme vendors DDOSing each other via their WP plugin code (that is, via your WP site), where one vendor is supposedly selling other vendor's plugin/theme, is a thing [1] (2019), so idk where you get the notion that things have changed ;) The whole "plugin" idea, where customization code can basically modify and monkey-patch whatever functionality it desires, has to go away, in WP and elsewhere. SGML has a concept of declarative pipelined markup stream processors to decorate and augment base HTML in a structured and bounded way. A "theme" should ideally only consist of CSS not arbitrary PHP. But I guess WP is a lost case, and has been for 20 years, in this regard. [1]: https://www.jemjabella.co.uk/2019/security-alert-pipdig-insecure-ddosing-competitors/ https://www.jemjabella.co.uk/2019/security-alert-pipdig-inse...
- shadowgovt 5y agoI have thought about moving my personal blog onto something that isn't someone else's service. But every time I think about running my own blog server, stories like this come along.
- b0ner_t0ner 5y agohttps://wp2static.com/ https://wp2static.com/ or https://www.strattic.com/ https://www.strattic.com/
- leppr 5y agoYou don't need to use WordPress where themes can apparently run server code. Plenty of simpler solutions like Gatsby and others.
- noahtallen 5y agoA theme is server code :) Since WordPress is PHP, rendering the front end is done in PHP on the server. A theme writes PHP to render custom templates, which (on top of styles) is a large part of what themes do in WordPress. This is changing to an extent with the Full Site Editing project, but themes and plugins are both very powerful and flexible in WordPress, which has in part led to its massive success.
- wanderingmind 5y agoSetup your blog in Github pages with Jekyll[0] [0] https://docs.github.com/en/pages/setting-up-a-github-pages-site-with-jekyll https://docs.github.com/en/pages/setting-up-a-github-pages-s...
- turminal 5y agoGithub is not their own server.
- yosito 5y agoWhy not move your personal blog to a static site generator?
- adam12 5y agoNot OP, but one thing that gets in the way for me is user comments.
- drexlspivey 5y agoCheck out https://utteranc.es/ https://utteranc.es/
- sneak 5y agoDisqus exists for this reason.
- sgallant 5y agoThis is 100% possible without a server. Your repo can be your database if you run it statically with something like Hugo (a single binary with no dependencies). Store your content in your own repo in Markdown files (or something similar, like MDX) and host it on Netlify, Vercel, AWS, etc. If your site has 10K posts and you don’t want to deal with long build times, use Next.js with ISR (make some high traffic pages static, others dynamic (server side rendered)). As the founder of Forestry.io and Tina.io, I’m biased about a content editing UI, but there are many options if you want a GUI on top of your content files. You got this.
- hanklazard 5y agoAgreed! I’ve used Hugo + Netlify for the last few years, really like it. I’m not a big blogger, but it would be easy to run a blog with this setup.
- sneak 5y agoYou don't need Netlify for this; all you need is a git repo somewhere and CI. CI can do the build, and the last step of CI can be ftp, rsync, scp, or whatever. It's just static files, normal hosting anywhere is fine.
- deleted 5y ago[deleted]
- viraptor 5y agoThere's usually a huge difference in access latency though. The usual cheap ftp hosting means a choice of whether you want to be 200ms away from the US or from Australia.
- lolinder 5y agoAs others have said, static site generators are super easy to set up, and for a blog you'd be able to do basically everything in Markdown. You can also very easily include Netlify CMS or similar for a GUI editor (which will make commits directly to your repo). I'd recommend at that point just using GitLab or GitHub pages as others have suggested, but if you do want to move completely off of other people's services, it's much simpler to set up nginx or Apache to serve static files than it is to safely host a WordPress instance.
- pmlnr 5y agoSSGs are not "super easy" for non-devs. What's super easy is things like https://www.silex.me/ https://www.silex.me/ or, with more functionality, https://pinegrow.com/ https://pinegrow.com/
- lolinder 5y agoHugo or Jekyll should be super easy for anyone who's seriously considered hosting their own WordPress instance, like OP is. If setting up a static site generator is too difficult, they definitely shouldn't be running WordPress themselves.
- temp8964 5y agoThe easy Hugo or Jekyll setups do not match the features of WordPress. So they are not easy.
- jiggunjer 5y agoWhat features are the main considerations?
- sneak 5y agoDoing everything in a web browser without editing local files, mostly. "Open a text editor" or "git commit" are enough to put off people who don't think of themselves as computer people even though complexity wise they are no different than WP, simply because you gotta leave the browser.
- 0xbadcafebee 5y agoWhy do you not want to use somebody else's service?
- shadowgovt 5y agoFor me, mostly control. I've been writing my blog in Markdown for ages, but Blogger only natively supports its bad WYSIWYG editor or pasting raw html. I've decided the friction in pipeline is enough that I kinda want to cut it out of the loop.
- deleted 5y ago[deleted]
- sircastor 5y agoFor all the Hugo and Jekyll and other static site generators mentioned, you can run Wordpress locally and have it generate static output. Granted, it would be with a plug-in, but presumably not accessible from the outside world.
- withinboredom 5y agoYou can use php-fpm and nginx’s built-in fpm cache. No plugin required.
- z3t4 5y agoAnything that can be written to and executed from the Internet will be a security issue. The only thing your public facing web server should be able to write to is the log file.
- turminal 5y agoFor better of for worse, wordpress can at this point be considered critical infrastructure.
- cblconfederate 5y agowhy would it be for worse?
- deleted 5y ago[deleted]
- puskavi 5y agoIts too easy to setup and forget
- howdydoo 5y agoIdeally our critical infrastructure would have a better security track record
- deleted 5y ago[deleted]
- micromacrofoot 5y agoyeah and maybe companies will start paying for open source software, but I’m not holding my breath
- edgyquant 5y agoThe difference is that it is bad for business reputation when some of the largest companies on planet are regularly leaking data through exploits. Testing will become an economic requirement over time.
- forinti 5y agoI don't like PHP or MySQL, but WP is a pretty decent piece of software.
- dtjb 5y ago"BleepingComputer attempted to contact AccessPress about the compromise, but the contact form is not working." oof
- freebreakfast 5y agoThis isn't new, apparently. I found a tweet complaining about the same from October 2021.[0] 0. https://twitter.com/avillegasn/status/1450089053794230278 https://twitter.com/avillegasn/status/1450089053794230278
- theden 5y agoI think it's clear that the fewer plugins one installs (ideally none) the better, though it's difficult to follow this rule in practice. I recently had to set up a WP website from scratch, and plugins are a very common way for people to solve their problems (especially non-technical users). Plugins are even used for basic ops work like rewrite rules, backups, log parsing, caching—and I get it, for most people if they didn't exist they wouldn't have done the ops stuff, or solve many of the other types of problems, so it's kind of a blessing and a curse given your attack surface increases with each plugin and WP feature. I've learned that Wordpress really is what you make of it, directly proportional to the engineering effort you put in.
- edgyquant 5y agoI don’t think is really at all clear. Whether it’s word press plugins, or a few thousand JS or Python modules you install with npm/pip, the market has moved into this direction because it is the most efficient. The problem is 100% in testing which is something most places slack of at because people joining, if they do write tests at all, only test their additions to the codebase. It isn’t just Wordpress, either, I think that testing of large scale interconnected software is not yet a solved problem and whomever can devise a system that eliminates all the vulnerability types we’ve seen exploited over the last few years will become very rich.
- harikb 5y agoTesting, while required, is an orthogonal problem. I haven’t seen a “test” in any ecosystem that can detect a malware
- MeinBlutIstBlau 5y ago
- edgyquant 5y agoYeah exactly, that’s my point. We haven’t been developing and using a ton of test types we could realistically do now given the proper incentives. At some point, with more and more data being accumulated and more and more services being brought online, we will have to start adding more foolproof tests suites as it it’s reaching a point where it’s not just company reputation but national security that we’re risking.
- willis936 5y agoA few hops to get to the list of known backdoored themes and plugins: https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/ https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-...
- Helithumper 5y agoTimeline: 2021-09-22: Jetpack Scan team discovers the dropper and back door in the FotoGraphy theme, and tries to contact vendor about the initial finding. 2021-09-27: Confirm presence of dropper + back door in all current free plugins and themes downloaded from vendors website. 2021-09-28: Confirm that dropper + back door is not present on downloads from wordpress.org 2021-09-29: Trying to contact vendor again, with updates on new findings. 2021-10-14: Escalated to WordPress plugins team to try to obtain contact with the vendor. 2021-10-15: Compromised extensions are removed from the vendor’s site. 2021-10-16: Response from vendor 2022-01-17: Most plugins have been upgraded to new versions, themes have been pulled from WordPress.org. 2022-01-18 Public disclosure
- zzleeper 5y agoThat's really pathetic, to put it mildly. Three weeks between initial contact and removal of compromised themes. Four months until public disclosure.
- smoe 5y agoPublic disclosure by the people that found the backdoor. I couldn't find any disclosure about it by AccessPress themselves between 15. October when they pulled the compromised themes and plugins to now.
- freebreakfast 5y agoThriveThemes still hasn't released a disclosure on an attack from March 2021.[0] This seems to be par for the course among theme developers. 0. https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild/ https://www.wordfence.com/blog/2021/03/recently-patched-vuln...
- benatkin 5y agoI never download from anywhere but wordpress.org and a lot of others don't, and that wasn't attacked, so I disagree that it's "pathetic".
- 5y ago
- diontron 5y ago
- hirundo 5y ago"According to Sucuri researchers who investigated the case to figure out the actors’ goal, threat actors used the backdoor to redirect visitors to malware-dropping and scam sites. Therefore, the campaign wasn’t very sophisticated." "Threat actor" and "supply chain attack" sound like attempts to elevate a crime into terrorism. As if their intent was to keep food off of the shelves rather than theft and fraud. Aren't those bad enough?
- MathMonkeyMan 5y agoPolicing language helps with marketing. I'm not saying I like it, but what is the alternative? "Some randos with domain knowledge and free time made the system do something other than what its designers intended, and now are hoping that distracted or gullible users will get fooled into scams"?
- lolinder 5y agoBoth of those terms are technical terms with specific meanings, and they're used correctly here. It's no more intended to scaremonger than when a medical journal uses fancy words for different body parts... it's just how cybersecurity people talk. Threat actor: https://en.wikipedia.org/wiki/Threat_actor https://en.wikipedia.org/wiki/Threat_actor Supply chain attack: https://en.wikipedia.org/wiki/Supply_chain_attack https://en.wikipedia.org/wiki/Supply_chain_attack
- MangoCoffee 5y agoevery time a WordPress news show up on HN. there are a lot of comments about WP being the worst software but where's the replacement?
- nkozyra 5y agoFrom a technical sense there are plenty of alternatives, even similarly disliked platforms like medium or wix. The problem is none of them are interested in turning a basic CMS into a wasteland of kitchen sink functionality that aims to turn blogging software into the ultimate web swiss army knife. People are happy to build blog software, but that's not what WordPress' customer base wants. They want professional services in the form of a grab bag of sketchy plugins. Nobody's going down that path again. If the goal were simply "let's build a better blogging platform" or "let's build a better storefront platform" or "let's build a better music venue website platform" there might be a receptive audience. But the goal is "let's build all three in one and also 500 other use cases." Who would see that as a compelling goal in 2022.
- ohashi 5y agoStorefront... you have Shopify. The most valuable use case, people are building those. The problem is people want a million different things for lots of other stuff. Shopify now has its own ecosystem too. It's the nature of creating popular platforms that businesses rely on.
- propogandist 5y agoWIX is absolutely terrible, it cannot be compared to WP.
- PinkPigeon 5y agoI concur, many of my clients are 'rescues' from Wix and Wordpress and the only thing more hated than Wordpress is Wix. More often than not it comes down to the horrifyingly confusing documentation, inconsistent UX, hilarious over-promising the world + dog on landing pages, etc. Also, exfiltrating a website from Wix (changing the nameservers, which should take two seconds, like it does with any other hoster) is a huge ordeal. They make it very difficult.
- barneygale 5y agoRelevant bash.org: http://bash.org/?949214 http://bash.org/?949214 > <azonenberg> wordpress is an unauthenticated remote shell that, as a useful side feature, also contains a blog Circa mid-00s
- ozim 5y agoHaving the knowledge of 2022 this can be said about any web application or anything one exposes to the internet to be accessed by randoms.
- afrcnc 5y agosource, instead of this blog spam: https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/ https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-...
- vibdev 5y agoLove the McAfee Secure Logo at the bottom of the AccessPress site, that's how you know you can trust them.
- nicholast 5y agoThe frequency of stuff like this is why I am still on Medium.
- sascha_sl 5y agoIf you "just" want a blog, simply ignore the plugins option (or set WP_DISALLOW_FILE_MODS) and you get very similar outcomes.
- jeffbee 5y agoIt's not a "supply chain attack" when you wantonly deploy unreviewed code on your server. We don't need a fancy term for it. It is just jackass behavior.
- WaxedChewbacca 5y ago
- Ericson2314 5y agoWe really need to purge ambient authority in this industry. Completely. The alternative is a low-trust low-collaboration regression to 1990s style software development, and that is simply untenable.
- seanwilson 5y agoFor people recommending static sites to replace WordPress, what do you do if you want to give users a basic page builder in the CMS where you can easily preview the page before it goes live? E.g. bolting together page blocks for testimonials, feature lists and a contact form with some basic customisation like colours and images. Markdown only support is straightforward but most company websites need a bit more than this. Accurate page previews before production deploys is really important too. Open source preferred as well.
- hellojere 5y agoNext.js, and most likely all the big players, can achieve that. I use Prismic for a lot of projects, and here's documentation about how to achieve previews with it and Next.js https://prismic.io/docs/technologies/previews-nextjs https://prismic.io/docs/technologies/previews-nextjs
- post-it 5y agoYeah, easy, all you have to do is rewrite WordPress in JavaScript. Now instead of worrying about malware in plugins, you can worry about malware in plugins and your npm dependencies!
- fastball 5y agoThe problem with WP is that its being run in a privileged position. A statically generated site is not.
- Tomte 5y agoSince most people don't seem to be aware: you can use Wordpress as a mostly-static website generator. Use WP Super Cache, and most of your pages are static anyway. A small PHP stub will be hit still, but if you don't even want that, you can just serve the generated static pages without it. It's well documented, you just edit your httpd.conf/.htaccess or your nginx config to serve the static files generated by the plugins. Only logged-in users (in most personal Wordpress installations: "just me") or recent commenters, depending on configuration, hit any PHP code at all. Oh, and commenting works, unless with SSGs out of the box. Keep the number of plugins small, use a static plugin and security is mostly a non-issue for a personal weblog (it's different for a "real" media operation with all kinds of complicated workflows, of course).
- Apofis 5y agoWordpress is one of the most insecure platforms out there. Avoid using it if you care about security.
- Tomte 5y agoAs I said: with this setup, all the readers (everyone but me) do not even hit any Wordpress code anymore. It truly is a static site generator. You can look at the generated HTML files in the file system. That's what the web server serves.
- speedgoose 5y agoIf you can login or comment, you do hit Wordpress code right? It could be fine if you put the admin portal behind a firewall but I would also recommend moving forward and stop developing new websites using Wordpress if you care about security. And you should probably care about security.
- KarlKemp 5y agoIf it generates something, it can still do whatever it wants with the generated files if the purpose is to, for example, embed spam links. If the server is the target, it either still has access to it, or to some alternative computer which, for a private individual writing a blog, will be their much more valuable personal device. Yes, you can spin up a VM, generate html, run it through all sorts of tests and only then upload it. The victims of this hack aren’t going to do that.
- skilled 5y agoThey are a pretty big vendor in the space, so it's quite surprising not to see an official update from them on their blog.
- sascha_sl 5y agoIf you professionally build a WordPress site, please consider turning off the native plugin and theme management, and replace it with composer and files non-writable to PHP. https://roots.io/bedrock/ https://roots.io/bedrock/ is a neat boilerplate for how this can be done.
- berkes 5y agoI've grown a now-popular wordpress hoster. We tried a "secure plan", which, a.o. ran the WP codebase on read-only filesystem (technically: chrooted, so WP could not change its own codebase). We pitched this with the "professionals" amongst the customers. They liked the idea, but abandoned it nonetheless. Too many themes won't work OOT. Too many plugins write files. Too many features appeared "broken" to their clients. When someone logs in as root, hits the update-button and gets errors, they consider it crap, rather than "proper security practice". So, while it seems nice in theory, the practice is -unfortunately- not there yet: as long as it is not the de-facto way, but an obscure, unfamiliar way, to run a WP site, people will too often abandone it. A feedback-loop causing it to never become really secure.
- sascha_sl 5y agoI am not too surprised by this. When I was doing agency work I was fortunate enough to be able to set a priority for security and build most things from scratch, only using a hand full of utility plugins (e.g. ACF) where I could have at least a glance at the code doing things well. Anyone who has a site valuable enough to do that (and use a git workflow) should be using a framework like Bedrock. I've never had a positive experience with a theme that had a thousand built-in options or even turned WP into a fully blown site builder. The code quality - both of the plugin/theme code and the generated markup - was usually quite bad. I imagine the main audience for managed WP hosting is there.
- etewiah 5y agoThere has got to be a big market opportunity for people who create "wordpress for xxxx" - alternatives for different sectors. The sector where WordPress gets "mis-used" most is real estate. It really isn't designed for that usecase: https://smallbusinessforum.co/why-an-alternative-to-wordpress-is-needed-for-real-estate-websites-ff82de096d93 https://smallbusinessforum.co/why-an-alternative-to-wordpres...
- ohashi 5y agoMight be good to disclose you're promoting your own company
- 6510 5y agoMy blog is one small php file that can 1) load a html document (that is a blog post) into a textarea. 2) Write out a html document by sticking html above and below that what sits in the text area. 3) find links to the html document on the index page, rss feed and tag pages. 4) load and update the index and tag pages. It does 4 whenever a html document (post) is saved. There are no bugs in my code. There isn't enough of it to have bugs. php stopped working at least twice over the life of my blog. As all pages are static html everything simply continued to work with the exception that editing and posting had to be done over ftp. I download wordpress OS one time and spend a few hours gazing over the thousands of files. I remember thinking sarcastically how I wish I had that level of confidence in my own code. What could possibly go wrong? I do still admire the company and the project.
- kichimi 5y ago>There are no bugs in my code. There isn't enough of it to have bugs. So I take it your code could handle a 1GB blog post safely without giving you an error about exceeding post_max_size or something similar? That would be a bug. Small code != bug free code.
- 6510 5y agoI've never tried inserting that much text into a textarea. > To prevent users from causing server timeouts, the default maximum upload size in WordPress typically ranges from 4 MB to 128 MB. > Google will index up to 2.5MB of an HTML file. But I read lynx has no issues with giant html files. If I had a need for it I could use ftp. If the need is frequent I could upload chunks of textarea at a time. Until then I'm going to consider it undesirable.
- kichimi 5y agoThat's fair, but my point was small code doesn't mean bug free, and just because you only use it in a certain way and don't see any bugs doesn't mean they're not there. In fact I'd wager there are multiple gaping issues with it, that you simply wont encounter. If your code is as small as I'm imagining it, then it's not handling a lot of error cases, and doesn't cover any edge cases. That's where bugs lurk.
- Wolfenstein98k 5y agoEverything you don't personally write is an attack vector.
- enqc475u 5y ago
- babbledabbler 5y agoI recently had to take over a wordpress site for a volunteer project and it almost immediately got hacked with spam despite taking great pains to not have this happen. Thousands of SEO pages showed up in the DB after installing some well known marketplace plugins. I was able to remove the hacked plugin and fortunately, it wasn't a big deal as this was just a temporary site for an event, but I would never work on wordpress again and I dissuade people from using it when I hear that they are considering it. It was great for its day, but times have changed and it's just not a secure platform. Any benefit given by all the plugins is outweighed by "hack roulette" you are playing when you install and customize them. There are now many other solutions out there that will be more secure and fit the need for most people.
- chillfox 5y agoThe key to running Wordpress securely is usually to set the file permissions correctly and protect all admin routes. Basically, don’t expose any write endpoints to the internet. And the easiest way is to use as few third party plugins/themes as possible. Base Wordpress is pretty secure if you put the admin panel behind a VPN and don’t install any plugins.
- imglorp 5y agoAs dismal as cesspools like Medium are, I'm starting to understand why they're options to self hosting anything at all. Managed services are someone else's security problem.
- q1w2 5y agoAs someone who runs a small company that self hosts as well as maintains our own hardware, it's great when things are running smoothly (>95% of the time), but when there's a problem, it's a complete time sink. On one hand, it's much cheaper, it's fun, makes integration work much easier, and I've learned a lot with each deep dive... ...but on the other hand, it can be more stressful, causes more downtime, and it a distraction to the mission of the company.