1

I'm thinking about posting a question/challenge to come up with a "sneaky" plugin, one that looks innocent, but can do stuff behind your back. I was inspired by the many filters in the plugins page: from a cursory glance it seems to be possible to "fake" an uninstallation, so that the site administrator might think the plugin is gone, but it is still there.

The benefit would be that we can learn more about WordPress, show off our coding skills, and maybe even improve the security of WordPress in the future by checking for these patterns. It could also attract more developers to the site, and maybe they even stay around to help others. The downside would be that malicious users could learn from it (but I don't think a smart evil hacker needs WPSE to learn the tricks), and that people could see WPSE in a negative light.

What do you think? Would such a question benefit or harm the site?

2
  • I really don't see the value in what you propose. But maybe that's because I really don't understand what you are even proposing. Either way, I agree with @Rarst and @Jeff Atwood; focus on the positive.
    – MikeSchinkel
    Feb 26, 2011 at 22:36
  • i accidently stumbled upon netpond dot com (not giving them a link over here). Fun as it is, they got tons of tutorials on how to missuse wordpress themes. I guess most authors won't appreciate such useage. Further more they also share themes over there. Maybe your idea can do something good (combined with the ideas from ottos blog post): Build a theme and let them use it (i don't know of any smilie that would be bold enough for this now).
    – kaiser
    Mar 30, 2011 at 14:13

3 Answers 3

Reset to default
2

Hmmm... Maybe try to reverse the question? For example "How to ensure there are no active plugins that don't show up in admin interface?"

Rather than figuring out how to do harm ask about how to detect and deal with it.

Good analogue would be viruses and antiviruses. People (ok - most people) don't ask how to write a virus so they understand it better. They ask about tools and methods that allow them to deal with viruses and be safe.

2
  • I'm afraid reversing the question would give us less interesting and incomplete results. Part of this exercise would be to broaden our mind, to think about future ways to secure plugin installation (cryptographic signatures? Would they make sense in a PHP environment?). If we ask the reverse question, the best answer is probably "install only via FTP, install only sources from WP.org. That should cover 99.99% of the situations." This is a nice answer, but I'm looking for a more engaging one.
    – Jan Fabry
    Feb 21, 2011 at 14:35
  • On Wikipedia we have a page called WP:BEANS (en.wikipedia.org/wiki/WP:BEANS)
    – Arlen Beiler
    Feb 21, 2011 at 17:43
0

On Wikipedia, we refer to WP:BEANS. After you read that page (it's short), consider that it would be worse to show Johnny how it's done after telling him not to do it (assuming he didn't know how originally).

Wouldn't it be better to have a private group working on it, instead of where everyone can take advantage of every weakness as soon as they find it. That way the bad guys wouldn't have time to exploit the groups findings before they were fixed, simply because they don't know about them. In short, it is a good idea as long as the enemy doesn't get the reports.

A lesson from WW2 is a good example. The American Military had someone stationed with the British Army (with their full knowledge) to learn the art of desert warfare, and how things were going. He was told pretty much everything about the war plans, which he sent back to Washington (again with Britain's full knowledge). Unbeknown to the allies, Germany was intercepting the messages, decoding them, and sending them to the commander of the axis forces in Africa. It all ended when this American was recalled, and another sent to take his place. The new man had a much stronger cipher, which resisted the Germans attempts at breaking it, allowing the allies to secretly build up an enormous force for the final blow. To put it in Churchill's words, "Before Alamein we never had a victory. After Alamein we never had a defeat."

While this isn't exactly the same (they thought they were secure), it does show what happens when the enemy (or in our case, the hacker) knows what we're doing.

2
  • I understand this concept, but I don't think it applies here. This is not about finding weaknesses in WordPress that can be exploited now to hack other servers, this is about code in plugins that you have to install. Have you read Anatomy of a Theme Malware that Otto wrote? This is the kind of information I would like to spread: challenging for most of us, and interesting for those that need to screen new plugins or themes for their own site.
    – Jan Fabry
    Feb 21, 2011 at 21:06
  • I agree that testing certain things, like this one, wouldn't hurt, though I think this is a great way to put this concept in stone for those who come after.
    – Arlen Beiler
    Feb 22, 2011 at 3:19
0

I have to say I don't like this idea.

The problem is that the intentions begin from a negative place -- to "tear down" or "prove wrong". Despite your intentions, there are plenty that will not understand (or worse not care) and assume you are in fact pursuing negative goals.

I'd rather you choose something that starts on a more positive note, such as building a great reference plugin.

There's a universe of great positive things to accomplish, why start out with a negative?

(I realized after writing this that I am echoing what Rarst is saying, too.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .