The Pipdig Drama: What you need to know, is your site at risk and what to do next…

As I am seeing so much discussion about Pipdig still, I thought I’d pop up a blog post trying my best to explain what is going on with Pipdig-and share the resources created by those who are far wiser than me.

Note before we begin: I am NOT a coding expert and the information I’m sharing are not my own technical analysis. I wanted to use this blog post to gather all the info I had found, (since I’ve done so much reading), and present it clearly in one handy space for those who need it; along with tips on the changes I’ve made to my blogs!

Like my guide to the new AD legalisation, I am very honest that I am NOT in any way qualified/experienced in this area-but what I do think I’m sometimes good at (big head alert!) is collating things and breaking things down into chunks in blogger-friendly terms. And that’s all I am trying to do here! Please read all the resources linked in this post from those who know their stuff!

What is the Pipdig Drama?

On Friday, publications emerged stating Pipdig’s plugin (which if you have a Pipdig theme, you’ll use) contained malicious coding. It was firstly reported by WordFence, who is very well respected in the industry for their WordPress security support. I mention that as some are arguing it’s only competitors who are writing about it-but Wordfence is a security plugin and resource site, so they don’t offer any themes or hosting. One would assume then that they don’t have anything to gain from this. Wordfence created this post flagging the issues of Pipdig’s coding. Blogger and developer Jem was investigating at the same time and wrote about it (in an easier-to-follow style I think) too. Her latest update is here.To summarise (and I said I’m not a coding expert so I apologise if I simplify the issue too much) the issues were…

Issue 1: Are Pipdig using your blog to attack a competitor?

Pipdig were alleged by the above sites to be performing DDoS on a competitor. A DDoS is a type of cyber attack where you flood a target site with requests/traffic so it’ll disrupt them. If you think of how your site sometimes crashes/slows when you have a viral post then this is on a whole other scale! The allegations are that Pipdig were apparently doing this hourly via the blogs that used their theme (but not, it seems, those who used their own hosting-more on that in a second).

This presented itself in several ways. On twitter, some bloggers have mentioned there’s were massively slowing down as they couldn’t cope with the actions. This is how Jem discovered it as she was approached by a blogger who couldn’t understand why her site was slowing down massively. In Jem’s article, she explains that this was then confirmed by the competitor whose web host had discovered that many, many sites were surging towards her site ‘every second’ and this was causing her all sorts of problems.

Pipdig even confirmed this coding exists, in their original statement they said: “It seems to suggest that some of the “Author URLs” have been set to ‘kotrynabassdesign.com’. We don’t currently know why this is the case…we will be looking further into this issue and provide more information as it comes up…”

However, in their update a day later, they changed their answer to simply ‘no’, with no explanation of what they discovered in their investigation! (you can still see this here, just scroll down). I asked them why on Twitter several days ago but they haven’t replied.

According to the experts, Pipdig HAVE removed the code in their latest plugin. So with this in mind: the fact that TWO different sources discovered this code, the competitor’s host found the problem AND Pipdig admitted the code existed (and then removing it)-I am struggling to understand how this could be accidental or malicious.

Issue 2: Are Pipdig gathering data on users who are with different hosts, to target them?

Pipdig do hosting! Who knew! Well not enough people apparently. Remember I said that Jem’s article notes that the coding from above was different for those who were already hosted by Pipdig-so not to slow their site down?

Who is the first person you blame when your site is running slow? Brexit Your host! From the evidence, it appears that, according to the experts, Pipdig tried to use their code to make their followers think their host was slowing them down; so they might switch to them.

Another one from the @pipdig plugin. If you use one of their themes on @bluehost then they intentionally slow your website down by disabling the BlueHost cache plugin, then they can inject content with the title “Is your host slowing you down?” CC @jemjabella @heyitsmikeyv pic.twitter.com/48DUXsDyBj

— Nicky Bloor (@nickstadb) March 31, 2019

This isn’t an isolated case as Jem notes their code has a function to run a list of those who use lyrical host (As you know I do and think they’re ace but I won’t link or anything as I don’t want to look like I’m trying to gain from this post). I have copied this short chunk of text from Jem’s post- can you spot the reference?

if (!get_option('p3_check_linkded')) {
	$error_src = parse_url($me, PHP_URL_HOST);
	$dns = dns_get_record($error_src, DNS_NS);
	if ((isset($dns[0]['target']) && (strpos($dns[0]['target'], 'l'.'yr'.'i'.'calhost'.'.co'.'m') !== false)) || (isset($dns[1]['target']) && (strpos($dns[1]['target'], 'ly'.'ri'.'calhost'.'.co'.'m') !== false)) ) {
		

Jem explains they deliberately put the spaces between them so it is not easily searchable. I have no idea how to search code but presumably if one searched ‘lyrical host’ it would not come up as this code has so many spaces/ dots between it.

So that is TWO different hosting providers that Pipdig allegedly is keeping track of via your blog; with allegations, they deliberately slow those sites down so you will think it is your host and switch. Pipdig deny slowing down sites but do not explain in any way that I can see why the code was there about their competitors. My question is why on earth do Pipdig need information on your host? If there was a legitimate reason, they would acknowledge it and not break the code up so much it is unsearchable, surely? Experts confirm this is also deleted in the latest plugin.

Issue 3: Is there a Kill Switch? Are Pipdig Disabling Plugins?

This is what seems to have caused the most amount of drama. Wordfence discovered that a number of Plugins are disabled by Pipdig. I won’t spend too much time on this have Pipdig have admitted this in their statement -although many developers are not happy with their explanation of it. Wordfence explains: “Whether or not the given reasons for deactivating these plugins are legitimate, it’s at best questionable practice to make these sorts of changes on behalf of your users without their knowledge.”

The next discovery is what is being described as a ‘kill switch’. Wordfence noted the code gives Pipdig ‘the ability to delete a site’s entire WordPress database remotely’ Jem adds ‘Executing this code would wipe your entire blog and unless you had a recent back-up (which most bloggers don’t) you’d have to start again.’ Pipdig denies that they have the ability to do this or have done it-but have deleted this code in their latest plugin according to the experts. Some developers have claimed that they believe Pipdig DO have the power to use a kill switch.

UPDATE: Jem has reached out to me in the comments to say some bloggers have reported to her that there blogs HAVE been shut down. You can see the full description of this in the comments.

Managed to demonstrate Pipdig’s “kill switch” on a test install of WordPress with pipdig Power Pack (p3) v4.7.2. It worked, which confirms they have the power to remotely delete your entire blog & every post you’ve ever written simply by typing your blog URL into a text file.

— Michael Waterfall (@mwaterfall) March 31, 2019

Many bloggers are arguing Pipdig haven’t actually done this to anyone (to their knowledge) yet but developers argue that in their vast experience, this type of thing is just not the norm to have in a code. So whilst it might not have been followed through, we need to acknowledge many experts are claiming this is NOT normal behaviour.

It is even more complicated that the above three issues but I feel the above is enough to grasp the situation.

But Pipdig have issued a statement haven’t they?

Here is Pipdig’s statement for the interest of including all resources. As mentioned, I don’t know about code but to be honest, when reading it, it did not sit well to me.

They spend the first part claiming they’ve decided AGAINST rebuking allegations. I’m sorry but in my opinion, they NEED to rebuke these allergations.

They then spend the next few paragraphs, stressing how small a company they are, why they are being targetted by trolls and it’s all very sad. In my opinion, this is classic diversion tactics. As I’ve said before, we need to stop mixing up hate with accountability. The majority of responses directed at Pipdig are asking them to be held accountable and not ‘trolling’. Of course, there are always some rude individuals and this is not acceptable but Pipdig seems to have chosen to label the allegations of experts as ‘hate’ rather than answering them.

As I mentioned previously, the statement at points, also contradicts the previous version. They promised an update on Issue 1 in the first statement but deny it exists in the second. Remember that it is alleged that Pipdig deleted the coding so it was not in the latest plugin update and developers have shots of the two codes side by side. If it wasn’t malicious, I would ask: why delete it? Today developers now claim that Pipdig have since deleted their repository, this thread explains this (But a repository is loosely summarised as a place where previous data is stored and kept).

UPDATE: Wordfence have updated again in relation to Pipdig’s statement; explaining why this statement appears to conflict and why taking down the repository is so suspicious. You can read their full response here.

But lots of big bloggers have stood by them?

Pipdig have had fierce supporters with big bloggers claiming they trust them implicitly. Unfortunately, their main reason for this seems to be that they believe Pipdig are nice or have known them for a long time. Over extensive searching on twitter the past few days, I could not myself discover ANYONE with tech knowledge who appeared to be defending the coding rather than their customer service and loyalty.

Lots of bloggers say they have not had any problems since using Pipdig. Could that be kind of the point? If everyone’s site was crashing left, right and centre, then we’d all be suspicious! Do you read code? I don’t. I’d imagine if you read code well enough, you’d probably have your own amazingly designed site and wouldn’t need Pipdig. Like many blogging-focused companies, you could argue that Pipdig has relied on the fact we don’t know code. Any company would want us to love their customer services so we’d stay loyal and switch to their hosting. So the fact there customer service is great really has nothing to do with this.

I find it really irresponsible that these bloggers have chosen to tweet without even pointing readers in the direction of resources to make an informed decision. Or you know, read a resource themselves. As I said, I do not have coding experience but I spent hours and hours reading and educating myself before making a decision to change themes and tweet about it. And in this post I am pointing you to every resource. How dare they put their fellow bloggers sites in danger just because they think someone is a nice bloke?

What do I need to do?

The first thing you need to do NOW is to make sure that you update your plugin on WordPress to the latest version. UPDATE: Pipdig have updated this plugin again today of the 2nd April! So you’ll need to update again (to version 4.90)

According to updated posts by Wordfence and other experts, the latest version does not have any of this coding so technically speaking your blog will be temporarily safe. This code does still disable some plugins but cannot ‘kill’ your blog (and let’s face it, Pipdig would be pretty bloody stupid to attempt any of that at the moment). Also make sure you back up your site. If you don’t have the new plugin, then it could be argued your blog is not safe.

Your site is not going to disappear this instant (one would hope!) as long as the plugin is now updated. The problem is, this is only a temporary measure because Pipdig, like any developer, can change the code in the plugin again and create updated versions. Therefore, if we believe the allegations of what they’ve done before, why not again? And if you didn’t know it was happening before, why not again? So it then comes down to trust.

And of course, another problem is the tech experts are telling us what they have done is wrong and to support that would be, well… not great!

So for most of us, the next step is probably to get a new theme. A tip: make sure you disable your Pipdig plugin BEFORE you upload a new theme; because in some cases the plugin doesn’t work with the new theme and it renders your site unusable (your host can fix it but it’s annoying). Also if you get a message about a CSS sheet errors, that’s nothing to do with Pipdig-it just means you need to only upload the specific theme file and not the whole ZIP file.

But how can we know if another theme provider could do the same? Well, we don’t with 100% certainty. But the outrage this has caused shows it is a rare occurrence. I purchased a beautiful theme with https://www.kotrynabassdesign.com (this is the company who Pipdig malicious targeted but note she has asked sites not to link to her directly so she doesn’t get associated -so is clearly not wanting to benefit it!) and also one from Creative Market Both of these have come highly recommended and have a good reputation from the research I’ve done. Alternatively, use a theme direct from WordPress themselves because if we can’t trust WordPress, welll.. you get the point.

If you are on Blogger, then whilst it is likely not advisable to stay with them long-term, from my reading it is thought your risk is lower since we all know WordPress is much more technical than blogger. Therefore the actions Pipdig could take with Blogger blogs would be more limited. However, it comes down to just not really knowing.

UPDATE: It is now advised that those on blogger need to switch their theme too. Wordfence have now noted: “During the investigation of Pipdig’s WordPress plugin and themes, we also came across some curious code associated with their Blogger themes. This code is part of Pipdig’s suspected DDoS campaign against their competitor, and was active until April 1, four days after Pipdig’s denial of any such behavior.” In other words, it is claimed that issue 1 was still happening as recent as 1st April in blogger blogs They state: “Wordfence recommends removing all Pipdig content from your sites, both WordPress and Blogger. Pipdig has demonstrated a willingness to abuse users’ resources to execute unethical, and potentially illegal, activity. Furthermore their repeated denial of solid evidence, and subsequent attempts to conceal it, leave us unable to trust them in the future.”

I hope this post is useful. What you decide to do is absolutely your choice, but at the very least do a bit of research and update your plugin!