7 ms·
Attempt to hack WordPress with a pull request
- nyodeneD 14y agoAre there any examples of hackers successfully inserting exploits into a popular codebase like this?
- charonn0 14y agoIt happened to UnrealIRC a few years back. The tarball on their website was adulterated to include a backdoor and the published checksums were altered too. They've since moved to cryptographic signatures for verification. http://www.irc-junkie.org/2010-06-12/some-unrealircd-3-2-8-1-downloads-trojaned/ http://www.irc-junkie.org/2010-06-12/some-unrealircd-3-2-8-1... http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt
- nl 14y agoThere was the famous attempt to insert a backdoor in the Linux sourcetree[1]. That wasn't quite the same as it wasn't a pull request (or equivalent), was instead done by directly modifying the CVS mirror of the BitKeeper sourcetree. [1] http://lkml.indiana.edu/hypermail/linux/kernel/0311.0/0621.html http://lkml.indiana.edu/hypermail/linux/kernel/0311.0/0621.h...
- tjdetwiler 14y agoI was expecting something subtle and clever.
- kevinconroy 14y agoNothing subtle, but he was clever in the sense that he managed to stuff a complete injection attack into his single file and included a Google-call in case his script didn't recognize the operating system. Worth a read not because it's a genius-level hack, but worth to see the breadth-first attempt that the attack takes to utilize a number of strategies. Realizing the number of attack vectors that you have to defend against is key to writing secure code. In that sense, I wonder if there are other good examples of attack code hosted on github somewhere. Seems like there's as much to learn from "black hat" code attacks as there is from doing code reviews on your own codebase.
- TazeTSchnitzel 14y agoIt's cool and all, but I get the feeling that the pull requester probably didn't write the code.
- notJim 14y agoHacks like this are commonly available. Back when I was working with Wordpress more, I saw them a few times. What's kind of cool when you see them is that they're often obfuscated several layers deep, so getting to the code is kind of like a puzzle.
- ohashi 14y agoSo he just put in a remote shell and removed the actual code? I've found a couple remote shell scripts on my server over the years as they got compromised, I was always impressed with how much they could really do from 1 file to my server. Scary stuff.
- ck2 14y agoWP has absolutely no room to be making fun of security issues. They caught this one because it was an obvious attempt, but their track history sucks. Mocking evil hackers is a very stupid idea. Oh and I believe they tried this because someone was successful in the past if I remember correctly.
- scribu 14y ago> Mocking evil hackers is a very stupid idea. So, every script kiddie is an "evil hacker" now? > Oh and I believe they tried this because someone was successful in the past if I remember correctly. Source?
- ck2 14y agoAt least one incident here, my memory is clouded by all the issues over the years: http://it.slashdot.org/story/11/06/22/1241241/wordpressorg-hacked-plugin-repository-compromised http://it.slashdot.org/story/11/06/22/1241241/wordpressorg-h...
- scribu 14y agoThanks for the link, but inserting commits by hacking the infrastructure isn't quite the same as having a pull request officially merged. Even the Linux infrastructure was hacked not too long ago. More such example here: https://news.ycombinator.com/item?id=4464303 https://news.ycombinator.com/item?id=4464303
- DigitalSea 14y agoVery clever but given Wordpress's security track record when it comes to code exploits I wouldn't have been surprised if this somehow made its way into the core. Good code for learning how some particular Wordpress exploits work.
- pervycreeper 14y agoAre you saying that someone who hasn't read the complete source code of all the software he uses is a moron?
- pervycreeper 14y agoOops, meant to reply to http://news.ycombinator.com/item?id=4464955 http://news.ycombinator.com/item?id=4464955
- adrinavarro 14y agohttps://github.com/maxymax https://github.com/maxymax I'm quite intrigued by his profile. Note the '10,000 commits with 255,815 additions and 29,562 deletions'.
- alpb 14y agoOh God how could possibly do 10,000 commits on a single file?
- xymostech 14y agoFailing to merge? I dunno, if you look at the changelog it's the past 10,000 commits plus one of his at the end.
- duskwuff 14y agoNot sure, but possibly by attempting to insert a malicious commit into the history and rebase everything else over it.
- Shank 14y agoThat would be this pull request he sent: https://github.com/WordPress/WordPress/pull/19 https://github.com/WordPress/WordPress/pull/19
- e03179 14y agoMember Since: Aug 31, 2012
- zoul 14y agoSweet Jesus the discussion under the request looks like MySpace. I sincerely hope that this isn't going to be the norm on GitHub in the future.
- deleted 14y ago[deleted]
- callahad 14y agoIt's already pretty common on any issue or pull request that gets a lot of attention and has an aspect of community drama. The Crockford / semicolon one isn't as bad straight out of the gate (https://github.com/twitter/bootstrap/issues/3057 https://github.com/twitter/bootstrap/issues/3057), but still...
- pooriaazimi 14y agoThat thread's been modified heavily since then. And I mean heavily. The first 300 posts were all memes back then.
- DasIch 14y agoThat's already the norm on popular projects. Github really needs to add features for moderation.
- tlrobinson 14y agoI don't see any harm in having a little fun on ridiculous pull requests/issues. On legitimate issues it could be annoying.
- misnome 14y agoThe comments on the actual diff https://github.com/wordpress/wordpress/pull/18/files https://github.com/wordpress/wordpress/pull/18/files are actually reasonably intelligent, and amusing
- deleted 14y ago[deleted]
- ballooney 14y agoIf you're going to be smug it's helpful to not be wrong!
- keithburgun 14y agoCould someone explain this joke to me, a total programming noob?
- TazeTSchnitzel 14y agoThey made a pull request - which basically means a request to change the source code - to insert a huge hacker console into wp.
- kghose 14y agoThanks. I'm with parent and very curious about what this is about. Does this console give root access to the server via a web interface?
- OtisBoxcar 14y agoSort of. It gives access with whatever user the webserver is running under. Might be root, but will usually be a less privileged user eg www-data.
- mcantor 14y agoThis is the programming equivalent of a politician embezzling money by writing a law that says "I get ten percent of all the money!" and asking everyone to pass it.
- Gamefoo 14y ago"An hilarious", really? Dude, spend a minute on your title. It's not Reddit here.
- jameyc 14y agoThat's actually correct - 'an' before a sounded 'h' is a style issue in American English, and still commonly used. In nearly every other English dialect it is a strict rule.
- ajhit406 14y agoYeah I was just going to comment on this too-- "a" vs. "an" actually has to do with pronunciation, not strictly words that begin with vowels. Maybe the author is Irish =)
- astrodust 14y agoWhat's peculiar is that "a house" or "a hose" is given to be correct, but "a honour" or "a hour" is not. It's probably that words with a more French origin, where the "h" is subdued, require "an" where the harder "h" from more Germanic words does not.
- newobj 14y agoLaugh now, but someone will pull it off one day.
- homakov 14y agoi'm envy. smart hack
- cheap 14y agoInstead of focusing on the pull request maybe we should think about better vulnerability trajectories. Next time don't make a pull request. Just fork the project, add some dumb feature someone will want or need, then leave your fork out there on Github. Morons will pull it down and use it without ever checking the code.
- ibotty 14y agothe pull-request seems to be deleted. for people that want to have a look at the (partly not yet obfuscated) commit will want to search for the sha 2fa93590c7881fab043be7b8b51358894dbc1466