Hacker Remix

Over 6k WordPress hacked to install plugins pushing infostealers

27 points by sandwichsphinx 9 months ago | 14 comments

pluc 9 months ago

Guess all the "Automattic security team" is busy looking for vulnerabilities in competing products.

bigiain 9 months ago

It is, of course, a malware writer's first amendment right to publish those plugins...

https://ma.tt/2024/10/first-amendment/

sksxihve 9 months ago

What share of the revenue do the hackers owe Automattic?

claudiulodro 9 months ago

Great snark from people that apparently didn't read the article, but this article is about hackers using stolen admin credentials to install a malicious plugin that renders popups with malware to site visitors.

stefanos82 9 months ago

After years of using and developing custom solutions with WordPress, as soon as I saw the checkbox fiasco, I said enough is enough and to call it quits with WP as a whole and deleted all my projects; I prefer to invest my time and energy elsewhere, it's not worth it anymore.

browningstreet 9 months ago

I have a few major wordpress projects that rely on a commercial Wordpress plugin. There’s no place for me to go, at this moment in time.

But I’m also personally getting tired of all this. I was prepared to dump Apple when they had their CSAM initiative. I bought a Tesla and then Elon goes super mad. I run Wordpress sites for my income and Matt goes super mad. I run Linux as much as I can but a lot of my media output is dependent on binary supported video output.

OSS is the foundation of our cloud layers but not amazing for desktop loads. Commercial companies are quite shady nowadays, and people like me who built their incomes on it have to consider how principled they are want to be. If I want to stay commercial and prioritize my income, I can’t even really entertain the principle dimension in my tool chain.

pessimizer 9 months ago

Wordpress isn't OSS, it's Free Software.

bigiain 9 months ago

Isn't GPL about as "OSS" as you can get?

What distinction are you drawing between "OSS" and "Free Software" here?

left-struck 9 months ago

Something can be open source but not free as in freedom, as in you can see the source but copyright is reserved, maybe that’s what they mean? But WP is also open source and they specifically said it’s not so idk

Flimm 9 months ago

WordPress is licensed under the GPLv2 license (or later), which is an open source license. It is also a free/libre licence.

The OSI is the only widely accepted authority on the definition of open source in software. You can find the open source definition (according to the OSI) here: https://opensource.org/osd The FSF and Richard Stallman have released their definition of free/libre software here: https://www.gnu.org/philosophy/free-sw.en.html .

As you can see, the definitions of open source software and free/libre software are almost identical for all intents and purposes. This was not accidental, when the OSI wrote the definition of open source, they derived it from the Debian Free Software Guidelines, which was highly influenced by the FSF's Free Software Definition. They wanted to rebrand free/libre software, which keeping the same criteria.

All open source licences are also free/libre licences, and all free/libre licences are also open source licences. The difference between open source and free/libre lies in the differences between the philosophies that the FSF and the OSI promote. The FSF say that using any licences other than free/libre is unethical, whereas the OSI does not comment on using software that is not open source. It's a matter of branding and of connotations.

nailer 9 months ago

Open source has a definition which is the open source definition. Software which has visible source code is not necessarily open source.

The authors of both free software and open source software still maintain copyright.

timschmidt 9 months ago

> OSS is the foundation of our cloud layers but not amazing for desktop loads.

That's news to those of us who have been using it for... check's watch... 25 years on the desktop.

browningstreet 9 months ago

Thanks for ignoring the previous sentence. It provided context for my following assertion.

timschmidt 9 months ago

Maybe I just don't understand what a "binary supported video output" is intended to convey?

Perhaps you could clarify how or why this task isn't possible with Linux?

Avoiding maligning the desktop worthiness of all of OSS because your niche app isn't available could have saved the exchange.

djvuvtgcuehb 9 months ago

[dead]