Sitemaker installed DIAMBER on my WP site (A hidden backdoor!)

[naya]

Hi all,

Recently I have handover a project to a member here, he provided me keywords and domain names, I had to buy the domains and hosts, his duty was to create 50 backlinks per site (On my package it had 2 sites) and 4 SEO articles per site.
I got two sites done today and found that one of the site got installed a stranger plugin called DIAMBER!!, woah, I just did small search and found that it's a backdoor to wordpress site. (Hope I'm wrong).

Now I have a concern,
Why that person installed that on one of my sites?
Can he do any pishing, or any other keylogging stuff using that. (When I use whatever the device to login to my wp site, can he get any other credentials by somehow).

I have asked him why did he install that and still unresponsive! super pissed off!
I will decide whether Im going to expose the person or not, of course based on your comments/suggestions.

I need your help to sort this out guys.
Thanks!

 

[thesyndicate]

Where did you find that info? Can you give us a link to that?

 

[naya]

Where did you find that info? Can you give us a link to that?

To diamber? or about the person?

 

[ramuite]

You should wait for GitHub Autopilot to come out for public and try web development yourself. Wait to get a website developed till then.

 

[DanDD]

Archive the plugin and send it to me via pm, ill analyze it

 

[naya]

You should wait for GitHub Autopilot to come out for public and try web development yourself. Wait to get a website developed till then.

Noted

 

[naya]

Archive the plugin and send it to me via pm, ill analyze it

Thanks mate.
Here's what I have found and exactly this was there before I deactivate and delete it.

I dont have the plugin now.

 

[nakamura]

Why don't you ask the member who did that? Or mark him here to answer it in public.

 

[Biycchu]

did not find any necessary information about DIAMBER

 

[naya]

Why don't you ask the member who did that? Or mark him here to answer it in public.

First I really wanted to know whats that plugin, I actually tried it on my site and it worked (tried after the thread here ) He keep saying he didnt, may be the host, namecheap did it he really wanted me to believe that. Haha...

I will expose later, no one should be treated like that, I was his customer!

 

[naya]

did not find any necessary information about DIAMBER

Couldn't find on github using the given youtube video (above) description. But it works.

 

[PrincZ]

care to share the link so we can click it?

 

[nakamura]

First I really wanted to know whats that plugin, I actually tried it on my site and it worked (tried after the thread here ) He keep saying he didnt, may be the host, namecheap did it he really wanted me to believe that. Haha...

I will expose later, no one should be treated like that, I was his customer!

Namecheap doesnt auto-install this plugin on Wordpress sites.

If it is true that this plugin can be used as a backdoor you should call him out so all the other customers will be aware of this as well.

 

[naya]

care to share the link so we can click it?

I don't have it mate, just uninstalled it. I was really upset.

 

[itz_styx]

Thanks mate.
Here's what I have found and exactly this was there before I deactivate and delete it.

I dont have the plugin now.

my god, this is so lame! real amateur stuff lol whoever uses that is a total noob.
but yea if you found it on your site after you hired someone its very suspicious.
however it could also be that the site just got hacked meanwhile and some kiddie added this shit.

 

[bossofthebosses]

First I really wanted to know whats that plugin, I actually tried it on my site and it worked (tried after the thread here ) He keep saying he didnt, may be the host, namecheap did it he really wanted me to believe that. Haha...

I will expose later, no one should be treated like that, I was his customer!

I've been using namecheap for years and they never have installed any plugin like that on my wp sites.

my god, this is so lame! real amateur stuff lol whoever uses that is a total noob.
but yea if you found it on your site after you hired someone its very suspicious.
however it could also be that the site just got hacked meanwhile and some kiddie added this shit.

To ensure that - OP what u can do is: inform a Mod about this and request him to contact with some of his previous clients here and see if they also got that plugin installed on their sites.

 

[naya]

Namecheap doesnt auto-install this plugin on Wordpress sites.

If it is true that this plugin can be used as a backdoor you should call him out so all the other customers will be aware of this as well.

I will, its a big thread, it seems he is randomly doing it, a week ago, to be honest I had 0 knowledge on wp and he knew that ( i trusted him and told that as he had 20-30 positive reviews!) He just installed that in only one site, not in the other. Now Im wondering are there any other ways to get access to a site in a backdoor without using a plugin!

 

[itz_styx]

I will, its a big thread, it seems he id randomly doing it, a week ago, to be honest I had 0 knowledge on wp and he knew that ( i trusted him and told that as he had 20-30 positive reviews!) He just installed that in only one site, not in the other. Now Im wondering are there any other ways to get access to a site in a backdoor without using a plugin!

of course, you can add a backdoor in 1 line of code to any php file. so it could be anywhere.

 

[naya]

of course, you can add a backdoor in 1 line of code to any php file. so it could be anywhere

of course, you can add a backdoor in 1 line of code to any php file. so it could be anywhere.

Hmm sad, I really wanted this to be done in a professional manner.
Is there a way for me to get my site analyzed by myself, other than something I will find on google?

 

[itz_styx]

you would really need to understand PHP and security to spot backdoors.
there are so many different ways to hide them, some really look like something normal and arent easy to spot.
if you suspect someone has added a backdoor you would have to compare the php files with the originals.
for example if you download a clean wordpress and then compare all files for changes.
same with themes and plugins. there are tools you can use, but again you need to know what to do.
the easiest is "diff" in linux which compares 2 files and shows you the differences.