How to effectively check backdoors in Wordpress? [plugins/themes]

[w001y]

Lately I hired some services in Fivver that include the installation of a premium plugin in the service.
Is there any way that these plugins are not infected or have backdoors?

I have also been tempted to use some that are shared here, sometimes they attach a virustotal scan, but I already read once on the forum that they are totally useless to detect any malicious php line.
On the other hand, I would also be interested to know how to leave a plugin pre-activated to be able to share it, without risking my license or purchase data.

Thank you very much in advance, for this doubt and for all the ones I have been able to solve thanks to the forum!

 

[scanningthru]

I've found that usually the code is hidden in a base64 line

 

[UpwardDescent]

The code can be very discreetly hidden and also obfuscated.
The only way to do this is to have a programmer go through each line and even then it could be missed.

 

[Dopious]

I have also been tempted to use some that are shared here, sometimes they attach a virustotal scan, but I already read once on the forum that they are totally useless to detect any malicious php line.

It all comes down to trust, do you trust the member that share a plugin, then download it, if not, buy a real license.

 

[w001y]

I was a member of a blackhat forum called isdark, the owner disappeared. But he used to put backdoors in plugins and themes then share them on other BH forums. And yes, you're correct, the virus scans are useless against malicious php code. The backdoors are usually to give them full control of your website / server.

Checking line by line? there must be something more sophisticated, right? I understand that the backdoor connects to external servers, then simply have a plugin that detects these strange connections.

Or something similar, I did not know the power of backdoors but sometimes I have feared even from Fivver trusted.

It all comes down to trust, do you trust the member that share a plugin, then download it, if not, buy a real license.

I'm sorry but I sadly stopped believing in the man's word a long time ago, at least on some issues. It's not a matter of buying or not, it wouldn't be the first time that paid products have backdoors either.

It all comes down to trust, do you trust the member that share a plugin, then download it, if not, buy a real license.

Oh by the way, I saw your signature, I was about to buy the service but I opted for another source, which I don't trust either.

I wonder what happens if someone comes to offer a good amount of money in exchange for putting a backdoor well done to the entire customer base, that could simply be done with an update of your base plugin no?

Well yes my friend, as you say it's all about trust, but it's often more difficult over the internet.

 

[shuttershades]

Use ClamAV or ImunifyAV to scan your files. The last one automatically scan and clean.

 

[Dopious]

Oh by the way, I saw your signature, I was about to buy the service but I opted for another source, which I don't trust either.

Just so you know, the signature is NOT my service, even if I trust the service provider.

 

[UpwardDescent]

Checking line by line? there must be something more sophisticated, right? I understand that the backdoor connects to external servers, then simply have a plugin that detects these strange connections.

Or something similar, I did not know the power of backdoors but sometimes I have feared even from Fivver trusted.

It doesn't always have to ping back to the central.
It could be a backdoor that's left in the code very discreetly and once your site is indexed the attacker will find your site with the help of search engines and use the backdoor to gain entry to your server.

 

[itz_styx]

the thing is, there are so many ways to backdoor php code, there is no scanner that would detect everything.
there are some clever tricks that even a programmer wouldn't spot if he doesn't have a security background.

 

[tidelow]

The best way to detect is have the original source downloaded in one folder and the suspected plugin in another. Use the software Atom to cross examine the files in the folders, you can compare files size, number of files, last modified dates, and lines of code file to file.

There is no wp scanner that will catch everything.

 

[w001y]

the thing is, there are so many ways to backdoor php code, there is no scanner that would detect everything.
there are some clever tricks that even a programmer wouldn't spot if he doesn't have a security background.

these codes can put the server at risk, or the other sites I share the server with? or just the wordpres installation?

Just so you know, the signature is NOT my service, even if I trust the service provider.

Why would you use that signature? do you use the service? btw I checked your giveaway, maybe I try oxygen, since time ago want to try if works better than elementor (what i don't think it's a challenge).

It doesn't always have to ping back to the central.
It could be a backdoor that's left in the code very discreetly and once your site is indexed the attacker will find your site with the help of search engines and use the backdoor to gain entry to your server.

yes, I suppose the topic is pretty advanced by now, but I'm still surprised to learn about it

The best way to detect is have the original source downloaded in one folder and the suspected plugin in another. Use the software Atom to cross examine the files in the folders, you can compare files size, number of files, last modified dates, and lines of code file to file.

There is no wp scanner that will catch everything.

Do you mean the legit one and the suspicious? Or just 2 different plugins?

Use ClamAV or ImunifyAV to scan your files. The last one automatically scan and clean.

There isn't an official list of hashes from the plugins.
I mean, Elementor pro for example must provide a has from the original file I guess, I remember once I got a hash after purchasing the plugin, but maybe ypu have to purchase before getting the has from the original licensed plugin.

 

[Dopious]

Why would you use that signature? do you use the service?

Yes, I use it, because it is a well known member of this forum that runs it, he does not take a dump in his own livingroom.

btw I checked your giveaway, maybe I try oxygen, since time ago want to try if works better than elementor (what i don't think it's a challenge).

Better buy it then, how can you trust me, you only known who I am for an hour or so ..

 

[w001y]

Yes, I use it, because it is a well known member of this forum that runs it, he does not take a dump in his own livingroom.



Better buy it then, how can you trust me, you only known who I am for an hour or so ..

I did not say that the service was yours, nor did I say that the seller should be doubted. I just find it curious that you advertise for free.

Anyway clearly the subject of my message is to find security mechanisms, up there you have several messages that indicate that sometimes it can be really difficult to find backdoors and also that the moderator of another forum put backdoors himself.

I don't understand that much trouble unless you are 12 years old or your plugins have prize, I think I'm simply asking a question.

And when I mentioned oxygen I expected you to tell me about your experience, not to cry.

Best regards and thanks

 

[Dopious]

I just find it curious that you advertise for free.

Who said anything about me advertise it for free, don´t assume things you do not know anything about.

 

[bartosimpsonio]

As others said, it's really hard finding malware in PHP. And yes, you'd have to audit custom code line by line.

Basically I trust WP core and that's all. Every other plugin or PHP file that goes in my servers get audited.

Some plugins are tiny and easy to read. You download their ZIP before installing and take a look.

Others like Yoast are gigantic pieces of code. Yoast is open source, which is great because lots of people audit it, just to give one example. Closed source plugins are the hardest ones to audit and trust.

Today I find most plugins are unnecessary. Core WP does most of what plugins used to do in the past.

 

[tidelow]

Yes, I mean compare the legit one and the nulled. If you dont have access to the legit one, I suggest to buy it, compare and refund.

 

[KHer0]

Best way file integrity check. Compare text in 2 same plugins from different sources. Doesn't have to be the original one. No one can hide from this

 

[scanningthru]

Best way file integrity check. Compare text in 2 same plugins from different sources. Doesn't have to be the original one. No one can hide from this

Trouble is you need to compare it to the original clean file, which the author supplies.

 

[w001y]

Yes, I mean compare the legit one and the nulled. If you dont have access to the legit one, I suggest to buy it, compare and refund.

If I buy the legitimate one, I just use the legitimate one, don't I? What would be the point of comparing and still using the "nulled" one?

Best way file integrity check. Compare text in 2 same plugins from different sources. Doesn't have to be the original one. No one can hide from this

Yep, that's what I thought, now I'm looking the way to see the official checksum. Also could be that although being from different no official sources could be the same infected file.

As others said, it's really hard finding malware in PHP. And yes, you'd have to audit custom code line by line.

Basically I trust WP core and that's all. Every other plugin or PHP file that goes in my servers get audited.

Some plugins are tiny and easy to read. You download their ZIP before installing and take a look.

Others like Yoast are gigantic pieces of code. Yoast is open source, which is great because lots of people audit it, just to give one example. Closed source plugins are the hardest ones to audit and trust.

Today I find most plugins are unnecessary. Core WP does most of what plugins used to do in the past.

But yoast has a paid version, doesn't it? Closed source plugins you mean the ones that have to connect to external servers to work?

I also have that doubt, because some premium plugins work without the activation key, but others seem not to.
Then there are also the pre-activated ones, which I don't understand much either.

If you know the subject I would be very grateful for a brief explanation, I understand the open source or proprietary, but not its impact on the operating conditions in wordpress.

 

[bartosimpsonio]

But yoast has a paid version, doesn't it? Closed source plugins you mean the ones that have to connect to external servers to work?

I also have that doubt, because some premium plugins work without the activation key, but others seem not to.
Then there are also the pre-activated ones, which I don't understand much either.

If you know the subject I would be very grateful for a brief explanation, I understand the open source or proprietary, but not its impact on the operating conditions in wordpress.

That's the cool thing about Yoast, the open version is the paid version. Yes, some paid plugins often load activation PHP code (not just a code, but the PHP code itself) remotely too, which adds to the insecurity, others just check your license or activation number.

Xenforo has a neat system to check for backdoors. Every PHP file has a checksum. If the file changes (e.g. gets malicious code injected), Xenforo will detect it and report it to the admins. Wordpress doesn't have this at runtime that I know of. This is the closest I've seen to automated malware detection in PHP.