False Alarm: Warning for dev: [email protected] / Jacob Pedersen

[ConnorPeet]

Heads up for a developer, Jacob Pedersen, going with the email [email protected] or username frash23. Over in the MC-Market Skype chat we discovered that he's placed rather nasty backdoors in his some of his works, such as GravityPVP and Desteria.

While (as a former freelancer) I recognize there need for a fallback in the case of non-payment, but backdooring client work is an unacceptable and illegal way to go about this. Would not recommend hiring this developer.

 

[MCHelper]

Heads up for a developer, Jacob Pedersen, going with the email [email protected] or username frash23. Over in the MC-Market Skype chat we discovered that he's placed rather nasty backdoors in his some of his works, such as GravityPVP and Desteria.

While (as a former freelancer) I recognize there need for a fallback in the case of non-payment, but backdooring client work is an unacceptable and illegal way to go about this. Would not recommend hiring this developer.

Could you explain a bit more, what backdoors etc.

 

[ConnorPeet]

Could you explain a bit more, what backdoors etc.

Throughout the code on both linked sites, there's obfuscated code that injects a script tag which loads http://pj.gy/i.js. At the time of writing there is nothing at that address, but if the developer wanted to (or if his site was compromised by an attacker), he could do anything he wanted to the site and its visitors. Defacement, drive-by malware, phishing, you name it.

 

[MCHelper]

Throughout the code on both linked sites, there's obfuscated code that injects a script tag which loads http://pj.gy/i.js. At the time of writing there is nothing at that address, but if the developer wanted to (or if his site was compromised by an attacker), he could do anything he wanted to the site and its visitors. Defacement, drive-by malware, phishing, you name it.

Aha, so basically he could spread some malware. I got it thanks.

 

[frash23]

pj.gy/i.js is a security measure taken against people who steal code. The inclusion of the script has been discussed with each of my clients thoroughly, and I gave them the option to opt in on it. I have not inserted this script to any of my works without my clients saying "Yes, I would like this feature". I am very aware of my position, and I know what risks I can take - this is not one of them.

The script is there in case someone copies the code and is conveniently dumb enough to not remove it. Then I'd run a php or javascript script to evaluate visitors' address and redirect them to the original clients' site if it doesn't match the original site.


EDIT: Also, my email is now [email protected], not [email protected]. Moved some time ago

 

[frash23]

Just to add on this: I have access to Desteria's webserver (as I manage it), and have full permissions to edit any code on it (check line 3 on desteria.com's source).

I have absolutely no reason to be running the script on this site if my intention is to inject malware.

 

[ConnorPeet]

Okay, thanks for clearing that up. I was speaking with someone who worked with GravityPVP and he gave no indication that he was aware of these backdoors.

There is still the concern, of, if a third party gained access to your server, domain, or DNS, he would be able to attack client sites. If you're concerned about payment, a written contract and/or escrow would be much, much better than backdooring client sites.

 

[frash23]

Okay, thanks for clearing that up. I was speaking with someone who worked with GravityPVP and he gave no indication that he was aware of these backdoors.

I've only discussed with "Kyle |Zumph|", whom I assume is the owner of the server.

There is still the concern, of, if a third party gained access to your server, domain, or DNS, he would be able to attack client sites. If you're concerned about payment, a written contract and/or escrow would be much, much better than backdooring client sites.

This is true, and I have given it thought before.
I do host this solution on the clients' servers now, it's just a while since i plotted it in to Desteria and GravityPvP (where I hadn't thought of this issue).