Major issue with malicious update!

[JGVerhoef]

This reply has been marked as private.

[Kyle – SUPPORT]

Ok great

[JGVerhoef]

This reply has been marked as private.

[Melanie – SUPPORT]

Hi, I thought you said it was fine now? 🙂

[JGVerhoef]

Hi Melanie,

2.65 is fine yes, but it worries me that I was pushed the malicious update 2.64 through wp-updates.com on my WordPress install and that update 2.64 doesn’t show in the changelogs you keep in the documentation.

Please beware that wp-updates also pushes me valid updates, such as the latest 2.65. It’s just the update service within WP. I need to know though if I can trust those updates. I assume that you guys wouldn’t push malicious code, but then it must have come through an infection on wp-updates.com. Either way it has cost us in total 10 days to fix everything, so I just need to be sure that I won’t be exposed to a malicious update again.

Jeroen

[Kyle – SUPPORT]

Hi

Not sure what research Ed has done but the only thing I could find was a forum that explained the issue as being the social.png file is a php script which finds all records in servers database table and sends them to a specific host, so they can access your server. There has be no mention of it being anything to do with wp-updates.com

– Kyle

[JGVerhoef]

Hy Kyle,

I understand, please refer to my first post.

We were offered the 2.64 update of Dante through the WP update function. It doesn´t matter to me where the update comes from, but I saw it came from wp/updates.com.

Dante 2.64 contained malicious code: social.png. You guys are the developers of the Dante theme, my question was, and still is,
1) have you found out what caused this malware to be part of 2.64, and
2) can you garuantee that it won’t happen again?

I do not want to scapegoat, but I want to know if I can trust Dante and the updates that are provided.

[Swift Ideas – Ed]

This reply has been marked as private.

[JGVerhoef]

This reply has been marked as private.

[Kyle – SUPPORT]

No problem

– Kyle

[Swift Ideas – Ed]

Hi Jeroen,

No we weren’t, but thanks anyway! 🙂

– Ed