The Wordfence team, makers of a WordPress security plugin, write about WordPress vulnerabilities, malware, phishing, and breaches.
HN commenters link its posts on plugin malware and a spammer's tracked history, and mention Wordfence as the first plugin to install on WordPress.
> As I understand it, signifiers included command and control servers known to be under Russian state control.
If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1].
> Do you work in this field? I've basically only seen lay people suggest this.
I have seen journalists claim that only lay people suggest this.
To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/
[1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/
An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons:
- A hacked IP can be used by one…
I run http://www.wordfence.com - We provide customer support via Freshdesk for our paid customers (a ticketing system) and on the wordpress.org forums for our free customers that use our open source product.
I initially did CS myself along with my co-founder and it is tough work. The hardest is the context switching overhead. One minute you're coding or marketing, and then you have to switch into doing 2 or 3 hours of customer support. What is really tough is at the end of the 3 hour stretch, a customer with a real gnarly issue comes along and you have to do 30 to 45 minutes of actual work researching it to help them. You have to dig deep to go that extra distance.
Once our revenue scaled we could hire our first full time customer support engineer and wow. It was so awesome to have someone offload this and let us focus on all the other stuff (which we would eventually have to hire for too!). We have a team now, some permanent and some contractors.
So there's no easy way to do it and because it's a human intelligence task, it's super time consuming and super expensive. But I can't overstate the importance of great customer service. We are known for it in our space and it has really paid off. Competitors have dropped the ball in a big way and we have picked up the slack through excellence in customer service.
A few things I learned:
- Reply early, reply often. It's very important to most customers to simply be acknowledged.
- Everyone has a bad day and 90% of the time, a…
Here's a short list I compiled just for you Aaron, but you have to do your own reading.
http://www.theguardian.com/technology/2015/may/01/encryption-wont-work-if-it-has-a-back-door-only-the-good-guys-have-keys-to-
http://reason.com/blog/2016/02/18/4-reasons-to-fear-encryption-back-doors
https://www.servint.net/university/article/keep-the-back-doors-to-encryption-shut/
https://pando.com/2013/12/19/the-nsa-review-panel-says-encryption-back-doors-cant-be-exploited-by-foreign-spies-do-we-believe-them/
http://www.techrepublic.com/article/why-government-mandated-encryption-backdoors-are-bad-for-us-businesses/
http://www.newsweek.com/why-we-need-encryption-even-nsa-cant-decipher-352073
https://www.wordfence.com/blog/2016/02/wordfence-supports-strong-encryption/
https://www.rt.com/usa/319236-no-encryption-backdoor-apple-ceo/
http://www.techrepublic.com/article/encryption-you-cant-put-the-genie-back-in-the-bottle/
http://www.theguardian.com/commentisfree/2015/mar/04/backdoors-encryption-china-apple-google-nsa
https://www.yahoo.com/tech/defense-secretary-favors-strong-encryption-220358733.html
http://www.freerepublic.com/focus/f-news/3395743/posts
BTW Aaron, a sidedoor is just a backdoor on an adjacent wall...
The comment made about domain names not being trustworthy is why I like EV-certificates.
Some people (notably google) argue that EV-certificates add very little of value because the user can just as easily check the domain name. Thing is, I could probably get some paypal or google like domain. Even if I can't, I could use a data URI as in [1] to put https://google.com in the address bar.
Compare that to EV. To get a browser to display google (or googel, or paypal), I'd need to convince a CA to issue such an EV cert. Whilst that might not be impossible, it takes something close to a state-level actor. A lot of phishers operate below that level.
What EV gives over the domain name is a fully CA controlled part of the UI. Whilst the address bar is the 'zone of death by phisher' the EV bar is the 'zone of death by CIA/KGB'.
[1] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin.
There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2] on your server'.
The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on).
[1] https://github.com/SpiderLabs/ModSecurity
[2] https://perishablepress.com/7g-firewall/
[3] https://www.wordfence.com/
Wait... so if I write a WP plugin, I'm entitled to disable other plugins I don't like when people install mine? Of course not. That endurance cache is not the only one, there's a list of "plugins we disagree with" which are disabled:
https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/#highlighter_107885
As for hosting providers: GoDaddy, BlueHost, etc - yes, they're all bad. But that doesn't justify moves like these.
Serious question though, on the technical part: WP needs an advanced-cache.php file, which needs to be in wp-content in order for the cache to work; this will list as dropin.
Are you sure the endurance cache is MU and not dropin? (Genuine question).