Attempt to hack WordPress with a pull request

https://github.com/wordpress/wordpress/pull/18

by alpb • 14 years ago

117 40 14 years ago

tjdetwiler• 14 years ago

I was expecting something subtle and clever.

Nothing subtle, but he was clever in the sense that he managed to stuff a complete injection attack into his single file and included a Google-call in case his script didn't recognize the operating system.

Worth a read not because it's a genius-level hack, but worth to see the breadth-first attempt that the attack takes to utilize a number of strategies. Realizing the number of attack vectors that you have to defend against is key to writing secure code.

In that sense, I wonder if there are other good examples of attack code hosted on github somewhere. Seems like there's as much to learn from "black hat" code attacks as there is from doing code reviews on your own codebase.

TazeTSchnitzel2• 14 years ago

It's cool and all, but I get the feeling that the pull requester probably didn't write the code.

notJim• 14 years ago

Hacks like this are commonly available. Back when I was working with Wordpress more, I saw them a few times. What's kind of cool when you see them is that they're often obfuscated several layers deep, so getting to the code is kind of like a puzzle.

ohashi• 14 years ago

So he just put in a remote shell and removed the actual code? I've found a couple remote shell scripts on my server over the years as they got compromised, I was always impressed with how much they could really do from 1 file to my server. Scary stuff.

ck22• 14 years ago

WP has absolutely no room to be making fun of security issues.

They caught this one because it was an obvious attempt, but their track history sucks.

Mocking evil hackers is a very stupid idea.

Oh and I believe they tried this because someone was successful in the past if I remember correctly.

scribu2• 14 years ago

> Mocking evil hackers is a very stupid idea.

So, every script kiddie is an "evil hacker" now?

> Oh and I believe they tried this because someone was successful in the past if I remember correctly.

Source?

ck22• 14 years ago

At least one incident here, my memory is clouded by all the issues over the years:

http://it.slashdot.org/story/11/06/22/1241241/wordpressorg-h...

DigitalSea• 14 years ago

Very clever but given Wordpress's security track record when it comes to code exploits I wouldn't have been surprised if this somehow made its way into the core. Good code for learning how some particular Wordpress exploits work.

pervycreeper2• 14 years ago

Are you saying that someone who hasn't read the complete source code of all the software he uses is a moron?

pervycreeper2• 14 years ago

Oops, meant to reply to http://news.ycombinator.com/item?id=4464955

adrinavarro• 14 years ago

https://github.com/maxymax I'm quite intrigued by his profile. Note the '10,000 commits with 255,815 additions and 29,562 deletions'.

e03179• 14 years ago

Member Since: Aug 31, 2012

alpb• 14 years ago

Oh God how could possibly do 10,000 commits on a single file?

xymostech• 14 years ago

Failing to merge? I dunno, if you look at the changelog it's the past 10,000 commits plus one of his at the end.

duskwuff• 14 years ago

Not sure, but possibly by attempting to insert a malicious commit into the history and rebase everything else over it.

nyodeneD• 14 years ago

Are there any examples of hackers successfully inserting exploits into a popular codebase like this?

charonn0• 14 years ago

It happened to UnrealIRC a few years back. The tarball on their website was adulterated to include a backdoor and the published checksums were altered too. They've since moved to cryptographic signatures for verification.

http://www.irc-junkie.org/2010-06-12/some-unrealircd-3-2-8-1...

http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt

nl• 14 years ago

There was the famous attempt to insert a backdoor in the Linux sourcetree[1]. That wasn't quite the same as it wasn't a pull request (or equivalent), was instead done by directly modifying the CVS mirror of the BitKeeper sourcetree.

[1] http://lkml.indiana.edu/hypermail/linux/kernel/0311.0/0621.h...

zoul• 14 years ago

Sweet Jesus the discussion under the request looks like MySpace. I sincerely hope that this isn't going to be the norm on GitHub in the future.

callahad• 14 years ago

It's already pretty common on any issue or pull request that gets a lot of attention and has an aspect of community drama. The Crockford / semicolon one isn't as bad straight out of the gate (https://github.com/twitter/bootstrap/issues/3057), but still...

pooriaazimi• 14 years ago

That thread's been modified heavily since then. And I mean heavily. The first 300 posts were all memes back then.

DasIch• 14 years ago

That's already the norm on popular projects. Github really needs to add features for moderation.

tlrobinson• 14 years ago

I don't see any harm in having a little fun on ridiculous pull requests/issues. On legitimate issues it could be annoying.

misnome• 14 years ago

The comments on the actual diff https://github.com/wordpress/wordpress/pull/18/files are actually reasonably intelligent, and amusing

keithburgun• 14 years ago

Could someone explain this joke to me, a total programming noob?

TazeTSchnitzel2• 14 years ago

They made a pull request - which basically means a request to change the source code - to insert a huge hacker console into wp.

kghose• 14 years ago

Thanks. I'm with parent and very curious about what this is about. Does this console give root access to the server via a web interface?

mcantor• 14 years ago

This is the programming equivalent of a politician embezzling money by writing a law that says "I get ten percent of all the money!" and asking everyone to pass it.

Gamefoo• 14 years ago

"An hilarious", really? Dude, spend a minute on your title. It's not Reddit here.

jameyc• 14 years ago

That's actually correct - 'an' before a sounded 'h' is a style issue in American English, and still commonly used. In nearly every other English dialect it is a strict rule.

ajhit406• 14 years ago

Yeah I was just going to comment on this too-- "a" vs. "an" actually has to do with pronunciation, not strictly words that begin with vowels.

Maybe the author is Irish =)

astrodust• 14 years ago

What's peculiar is that "a house" or "a hose" is given to be correct, but "a honour" or "a hour" is not.

It's probably that words with a more French origin, where the "h" is subdued, require "an" where the harder "h" from more Germanic words does not.

newobj• 14 years ago

Laugh now, but someone will pull it off one day.

homakov• 14 years ago

i'm envy. smart hack

cheap• 14 years ago

Instead of focusing on the pull request maybe we should think about better vulnerability trajectories. Next time don't make a pull request. Just fork the project, add some dumb feature someone will want or need, then leave your fork out there on Github. Morons will pull it down and use it without ever checking the code.

ibotty• 14 years ago

the pull-request seems to be deleted. for people that want to have a look at the (partly not yet obfuscated) commit will want to search for the sha

2fa93590c7881fab043be7b8b51358894dbc1466

Attempt to hack WordPress with a pull request

Related Stories