• Resolved rudrastays

    (@rudrastays)


    Hi,
    Installed this security plugin yesterday. What I really liked was, it does not mess around with my Cache-Control headers. Also it is working efficiently. Checked the log files… well it does its job really well. It was acting hard upon the bad bots.

    But this morning I received an email stating the following

    Details for the problem files are below:

    The MD5 Checksum Hashes for following core files do not match the official www.ads-software.com Checksum Hashes:
    – wp-includes/js/jquery/jquery-migrate.js (www.ads-software.com source file)
    – wp-includes/js/jquery/jquery-migrate.min.js (www.ads-software.com source file)
    – wp-includes/js/mediaelement/controls.svg (www.ads-software.com source file)

    You should review these files and replace them with official versions if required.

    So to have closer look, I downloaded the latest wordpress tarball. and compared the files. I used the good old diff utility. At first I ran diff file1 file2
    Huge differences popped up.
    So I decided to pass the -w switch to the diff command, which basically tells it to ignore the whitespace changes.
    this is what I did diff -w file1 file2
    And than diff was not reporting any differences in files.
    So what I feel here is the hack protection tool does not ignore white spaces while comparing files. As a result. It is reporting false positives.

    Please correct me if my approach of looking at file differences is wrong.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Paul

    (@paultgoodchild)

    This system uses the the MD5 hashes taken straight from www.ads-software.com.

    It’s not comparing file content against other files, like you do, it’s taking a unique hash of the file content and comparing them against the official hashes.

    My guess is that you’ve used a 3rd party installer program and somewhere along the way the newline characters were replaced.

    The while there is in principle no difference apart from the white space, it’s not a false positive – it’s a positive as the files are different.

    That is the purpose of this tool – find anything that’s different. You can resolve the issue by replacing the files (use the option to automatically do so) and you wont be bothered by it again.

    Hope that helps!

    Paul, you are active and helpful with support in my experience … but this doesn’t really help so much. The email messages are not clear to non-techies. This is not to disparage the plugin itself.

    Maybe if this is important for the plugin’s development, there could be a facility to help point out these maybe-sinister file changes? It’s probably not workable, I don’t expect that, but please note that it is disturbing for the unwashed, like me, to find alarming email and not really know how to move forward. Googling commences, time taken, confusion reigns …

    There is an underlying issue of trust going on as well, which should be recognized. It looks a little corporatoid to ‘warn’ users about something and then offer your service to eliminate the problem, while leaving it to them to determine whether the ‘warning’ is consequential or not. I am not saying this is meant to manipulate users, surely it isn’t, but big tech has waylaid enough folks that an eye to consideration of user time and effort is probably becoming a necessary practice.

    Plugin Author Paul

    (@paultgoodchild)

    Hi John

    Thanks for your comments on this.

    I’d first outline that I haven’t offered any of our services – we don’t offer any services for repairing files here. The plugin itself has built-in mechanisms to repair the problem and that’s what I outlined above, in the email, and in the blog. Not me, not my services, no-one else. I’m not trying to “up-sell” here – there is no service/product to “up-sell” to in order to resolve this particular issue. It’s all handled in the plugin.

    The number of requests that I’ve received to our support desk that asks questions about this which have been outlined in the blog article (which is linked to in the email) is staggering. Many folks just aren’t reading the docs and instead are looking for a personal response. I understand why, but it’s not scalable.

    To address all this though, we’ve already started a follow up post to address common questions. And, I’ve added an improvement with the latest plugin release that now includes links within the actual email to repair the files directly. This should help.

    Putting all this accompanying support documentation in place takes time, but we’re getting there ??

    The problem is, unfortunately, getting everyone to read them.

    I’m particularly sorry to learn there is a problem of trust here. I’m glad you shared it though… I’d rather be aware of it than not. But in all honestly, until today, we have provided this plugin and supported it completely free of charge. That model will have to ultimately change we feel and we’re working on this also. Further details of this will be released in the next week or so.

    Thanks again for your comments and feedback John, I appreciate it!

    Thread Starter rudrastays

    (@rudrastays)

    Hello again,
    Sorry for a late response, and yes you are right Mr. Paul, MD5 hashes is the best possible thing to check for file differences. And obviously, even an extra space added anywhere in the file will change the MD5 sum altogether.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Looks like False positive email sent by hack protection tool’ is closed to new replies.