Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces

Ranjita Pai Kasturi; Jonathan Fuller; Yiting Sun; Omar Chabklo; Andres Rodriguez; Jeman Park; Brendan Saltaformaggio

Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces

Ranjita Pai Kasturi, Jonathan Fuller, Yiting Sun, Omar Chabklo, Andres Rodriguez, Jeman Park, Brendan Saltaformaggio

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

7 Citations (Scopus)

Abstract

Modern websites owe most of their aesthetics and functionalities to Content Management Systems (CMS) plugins, which are bought and sold on widely popular marketplaces. Driven by economic incentives, attackers abuse the trust in this economy: selling malware on legitimate marketplaces, pirating popular plugins, and infecting plugins post-deployment. This research studied the evolution of CMS plugins in over 400K production webservers dating back to 2012. We developed YODA, an automated framework to detect malicious plugins and track down their origin. YODA uncovered 47,337 malicious plugins on 24,931 unique websites. Among these, $41.5K had been spent on 3,685 malicious plugins sold on legitimate plugin marketplaces. Pirated plugins cheated developers out of $228K in revenues. Post-deployment attacks infected $834K worth of previously benign plugins with malware. Lastly, YODA informs our remediation efforts, as over 94% of these malicious plugins are still active today.

Original language	English
Title of host publication	Proceedings of the 31st USENIX Security Symposium, Security 2022
Publisher	USENIX Association
Pages	161-178
Number of pages	18
ISBN (Electronic)	9781939133311
Publication status	Published - 2022
Event	31st USENIX Security Symposium, Security 2022 - Boston, United States Duration: 10 Aug 2022 → 12 Aug 2022

Publication series

Name	Proceedings of the 31st USENIX Security Symposium, Security 2022

Conference

Conference	31st USENIX Security Symposium, Security 2022
Country/Territory	United States
City	Boston
Period	10/08/22 → 12/08/22

Bibliographical note

Publisher Copyright:
© USENIX Security Symposium, Security 2022.All rights reserved.

Cite this

Kasturi, R. P., Fuller, J., Sun, Y., Chabklo, O., Rodriguez, A., Park, J., & Saltaformaggio, B. (2022). Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces. In Proceedings of the 31st USENIX Security Symposium, Security 2022 (pp. 161-178). (Proceedings of the 31st USENIX Security Symposium, Security 2022). USENIX Association.

@inproceedings{8cde10777bc2414192252c602b94440b,

title = "Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces",

abstract = "Modern websites owe most of their aesthetics and functionalities to Content Management Systems (CMS) plugins, which are bought and sold on widely popular marketplaces. Driven by economic incentives, attackers abuse the trust in this economy: selling malware on legitimate marketplaces, pirating popular plugins, and infecting plugins post-deployment. This research studied the evolution of CMS plugins in over 400K production webservers dating back to 2012. We developed YODA, an automated framework to detect malicious plugins and track down their origin. YODA uncovered 47,337 malicious plugins on 24,931 unique websites. Among these, $41.5K had been spent on 3,685 malicious plugins sold on legitimate plugin marketplaces. Pirated plugins cheated developers out of $228K in revenues. Post-deployment attacks infected $834K worth of previously benign plugins with malware. Lastly, YODA informs our remediation efforts, as over 94% of these malicious plugins are still active today.",

author = "Kasturi, {Ranjita Pai} and Jonathan Fuller and Yiting Sun and Omar Chabklo and Andres Rodriguez and Jeman Park and Brendan Saltaformaggio",

note = "Publisher Copyright: {\textcopyright} USENIX Security Symposium, Security 2022.All rights reserved.; 31st USENIX Security Symposium, Security 2022 ; Conference date: 10-08-2022 Through 12-08-2022",

year = "2022",

language = "English",

series = "Proceedings of the 31st USENIX Security Symposium, Security 2022",

publisher = "USENIX Association",

pages = "161--178",

booktitle = "Proceedings of the 31st USENIX Security Symposium, Security 2022",

}

Kasturi, RP, Fuller, J, Sun, Y, Chabklo, O, Rodriguez, A, Park, J & Saltaformaggio, B 2022, Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces. in Proceedings of the 31st USENIX Security Symposium, Security 2022. Proceedings of the 31st USENIX Security Symposium, Security 2022, USENIX Association, pp. 161-178, 31st USENIX Security Symposium, Security 2022, Boston, United States, 10/08/22.

Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces. / Kasturi, Ranjita Pai; Fuller, Jonathan; Sun, Yiting et al.
Proceedings of the 31st USENIX Security Symposium, Security 2022. USENIX Association, 2022. p. 161-178 (Proceedings of the 31st USENIX Security Symposium, Security 2022).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Mistrust Plugins You Must

T2 - 31st USENIX Security Symposium, Security 2022

AU - Kasturi, Ranjita Pai

AU - Fuller, Jonathan

AU - Sun, Yiting

AU - Chabklo, Omar

AU - Rodriguez, Andres

AU - Park, Jeman

AU - Saltaformaggio, Brendan

PY - 2022

Y1 - 2022

N2 - Modern websites owe most of their aesthetics and functionalities to Content Management Systems (CMS) plugins, which are bought and sold on widely popular marketplaces. Driven by economic incentives, attackers abuse the trust in this economy: selling malware on legitimate marketplaces, pirating popular plugins, and infecting plugins post-deployment. This research studied the evolution of CMS plugins in over 400K production webservers dating back to 2012. We developed YODA, an automated framework to detect malicious plugins and track down their origin. YODA uncovered 47,337 malicious plugins on 24,931 unique websites. Among these, $41.5K had been spent on 3,685 malicious plugins sold on legitimate plugin marketplaces. Pirated plugins cheated developers out of $228K in revenues. Post-deployment attacks infected $834K worth of previously benign plugins with malware. Lastly, YODA informs our remediation efforts, as over 94% of these malicious plugins are still active today.

AB - Modern websites owe most of their aesthetics and functionalities to Content Management Systems (CMS) plugins, which are bought and sold on widely popular marketplaces. Driven by economic incentives, attackers abuse the trust in this economy: selling malware on legitimate marketplaces, pirating popular plugins, and infecting plugins post-deployment. This research studied the evolution of CMS plugins in over 400K production webservers dating back to 2012. We developed YODA, an automated framework to detect malicious plugins and track down their origin. YODA uncovered 47,337 malicious plugins on 24,931 unique websites. Among these, $41.5K had been spent on 3,685 malicious plugins sold on legitimate plugin marketplaces. Pirated plugins cheated developers out of $228K in revenues. Post-deployment attacks infected $834K worth of previously benign plugins with malware. Lastly, YODA informs our remediation efforts, as over 94% of these malicious plugins are still active today.

UR - http://www.scopus.com/inward/record.url?scp=85132285701&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:85132285701

T3 - Proceedings of the 31st USENIX Security Symposium, Security 2022

SP - 161

EP - 178

BT - Proceedings of the 31st USENIX Security Symposium, Security 2022

PB - USENIX Association

Y2 - 10 August 2022 through 12 August 2022

ER -

Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces

Abstract

Publication series

Conference

Bibliographical note

Other files and links

Fingerprint

Cite this