Obfuscated Variable Names in WordPress
A hidden script replaced variable names with similar-looking characters, causing thousands of errors and a frustrating investigation.
I was offered a very weird, but a very well-paid WordPress project a few years ago: The previous developer had a fight with the boss, so he did quit. And from that day the website didn't work anymore, even though "the code looked perfectly ok".
I cloned the production site so I could have a closer look at what was wrong. And indeed, nothing was working, but indeed the code looked perfectly fine. There were THOUSANDS of errors on every page, claiming that variables were unknown. Except they clearly were declared and used, sometimes on the line right above, without error.
I disabled plugins and strip WP to its lightest form, hoping to understand it all better. But still didn't see what the problem was.
I decided to diff the files with those from a fresh WP install, and noticed some lines were showed as different even though they looked identical...So I understood something here was fishy. I switched to HEX and went char by char (which can suck with UTF-8 btw) and then I saw what was wrong: some of the letters were not what I thought they were, but identically looking utf-8 equivalents!
The fucker had used his last work week writing a script, a pretty smart one actually, that replaced letters in some variable names, in some of the places they were referenced. And he actually left the script (containing a function to reverse the changes) well-hidden in an assets directory.
Well, that wasn't fun. But it was well-paid :)
Names and the company have been scrubbed. Stories are lightly edited for length and clarity, never for content. If something here is yours and you want it taken down, email me and it's gone.
Sign in to join in. Reading needs nothing.