We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jun 19·5 min read
From a 7 KB file to a 13-year backdoor operation
TL;DR
A seemingly innocuous 7 KB binary file in a closed WordPress plugin revealed a long-running backdoor operation. By decoding the file, a researcher uncovered a network of 27 plugins linked to a single operator over 13 years.
✦ Why It Matters
Engineers should prioritize security audits of plugins, especially those with unusual file types or behaviors.
Key Takeaways
- Conduct regular security audits on plugins.
- Investigate unusual file types in plugin closures.
- Monitor for patterns in plugin developer accounts.
- Stay informed about potential backdoor threats.
Full Summary
In the WordPress ecosystem, plugin closures usually indicate a lack of maintenance, but the deletion of a specific 7 KB binary file from the wp-advanced-math-captcha plugin raised red flags. Upon decoding this zlib-compressed file, a researcher discovered connections to multiple plugins and a single operator managing 19 accounts since 2013.
The investigation revealed a total of 27 plugins, with further exploration uncovering six additional burner plugins. This extensive backdoor operation exploited the WordPress platform, potentially affecting countless users.
The findings underscore the need for rigorous security reviews of plugins, especially those with unusual file types. By identifying and analyzing these hidden threats, developers can better protect their applications and users.