Author: clintonb11 – WP Beacon

Alerts (0)

No open alerts.

Show 1 resolved alert

Critical code_pattern Dell EDU Connect Resolved · fp_legacy_code_pattern_lowinstalls 12d ago

Slug	edu-connect
Pattern	`hardcoded_ip_url`
Kind	`builtin`
Version	`0.1.4`
Hit count	1
First hit	File `connect.php` Line 26 Snippet `define('DELL_CONNECT_SERVICE_URL','http://11.0.0.1:9001');`
Explanation	plugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) — legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths.

View raw JSON

{
    "slug": "edu-connect",
    "pattern": "hardcoded_ip_url",
    "kind": "builtin",
    "version": "0.1.4",
    "hit_count": 1,
    "first_hit": {
        "file": "connect.php",
        "line": 26,
        "snippet": "define('DELL_CONNECT_SERVICE_URL','http://11.0.0.1:9001');"
    },
    "explanation": "plugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) \u2014 legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths."
}

Plugins authored (5)

Plugin	Version	Installs	Last updated	Status
Dell EDU Connect ·`edu-connect`	0.1.4	10	9y ago	Active
Dell Cloud Connect ·`dell-cloud-connect`	0.2.3	—	13y ago	Active
dell-healthcare-connect ·`dell-healthcare-connect`	—	—	—	Closed
dell-higher-education-connect ·`dell-higher-education-connect`	—	—	—	Closed
Dell Virtualization Connect ·`dell-virtualization-connect`	0.2.1	—	14y ago	Active

Contributor on other plugins (1)

Plugins where this account is listed in the readme contributors (distinct from SVN commit access).

Plugin	Primary author	Version	Installs
Higher Education News Widget	mattlsmith	0.2.2	—

Clint

Alerts (0)

Plugins authored (5)

Contributor on other plugins (1)