4 replies
BUYERS OF THIS PLUGIN BE WARNED:

The plugin has a pretty severe security problem at the moment that allows anyone to create and download a full backup of your site (including passwords and any other sensitive into) - even if the plugin isn't active.

I made the sellers aware of this on the 6th August (three weeks ago) but it's still not been fixed.

If you are using the plugin, or know anyone who is (i.e. you're an affiliate who's sold it to your customers), do them and yourself a favour and get them to contact the plugin creators for a fix.

Thanks
Martin
#seamless #secure
  • Profile picture of the author RussGu3
    Wow, I didn't know about that.

    But I DID know that it completely screwed-up my site and it's been about 2 weeks and I still haven't been able to fix it.

    I contacted support and asked for some troubleshooting input and if they weren't able to do that, give me a refund.

    I got the refund only. No "we're sorry" or ANY support at all.

    I ran the malware checker (found a few minor things) and then a complete backup of my site with version 1. Then, a few days later they came out with version 2, so I deleted version 1 and installed version 2.

    I ran the malware checker again (nothing found) and went about my business, until I noticed that a lot of things were screwed-up in the admin interface (inaccessible pages / functions) and several things on the front-end display.

    It seemed to throw a bunch of jQuery errors that my host is currently working on finding and correcting.

    Oh, and when I tried to use the Restore function, neither version of the plugin would recognize the backup file I had created with it! WTF?!

    Bottom line: DON'T BUY THIS PLUGIN! Unless you like living dangerously...

    It seems that Radu H. is the programmer and Joshua Z. is the marketer for it. So, not only did I not get any support, the support tickets (emails) go to Joshua Z. and not the actual guy who wrote the code.

    And to add insult to injury, both of these guys launched new products during the time these problems were happening. And I never received even ONE follow-up email about the plugin.

    Both are now and forever on my marketer blacklist...
    Signature
    {{ DiscussionBoard.errors[9483825].message }}
  • Profile picture of the author NoGimmicks
    Having looked a little more into the code, I'm really not surprised that you had errors after using it.

    The fact that the "Malware cleaner" deletes content from your files without letting you know what it's deleting (and giving you an option to say "no!") is incredibly poor practice. You'll almost certainly find that it deleted perfectly good code that it incorrectly thought was malicious.

    I've no idea whether this (and the main security issue) have been fixed in the plugin yet but as it'd been 3 weeks after contacting the sellers before I publicly posted about the issue I very much doubt it. That lack of reactivity when it's something so potentially dangerous to their customers says a lot about the developers in my opinion.

    For what it's worth, I contacted the lead developer of iThemes BackupBuddy plugin many moons ago about a security issue they had with the plugin. The matter was fixed (and released to their customers) within hours.

    Now that is the kind of response you want when issues like this arise.

    I'd recommend that (iThemes) plugin without hesitation. I'd also be comfortable with getting decent support with anything else they released too as they clearly take things seriously.

    Cheers
    Martin
    Signature
    Sick of your products ending up on warez sites?
    Keep an eye out for StealthMarker...
    {{ DiscussionBoard.errors[9487475].message }}
    • Profile picture of the author RussGu3
      Well, it turned out that this plugin left a considerable amount of code behind upon being uninstalled.

      It was a bunch of RewriteRule stuff on the .htaccess file.

      If only we would have looked at that file first, instead of everything else...

      Anyway, after deleting all the junk code, the site came right back to its former self.

      Hours wasted because of a silly plugin. And the funny thing is, I do have BackupBuddy.

      Live and learn...
      Signature
      {{ DiscussionBoard.errors[9493562].message }}

Trending Topics