{"id":108322,"date":"2023-05-04T12:48:14","date_gmt":"2023-05-04T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108322"},"modified":"2023-05-04T18:45:37","modified_gmt":"2023-05-04T16:45:37","slug":"perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","title":{"rendered":"Byla p\u0159evzata kontrola nad 14 PHP knihovnami v repozit\u00e1\u0159i Packagist.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Spr\u00e1vci repozit\u00e1\u0159e bal\u00ed\u010dk\u016f Packagist zve\u0159ejnili informace o \u00fatoku, b\u011bhem kter\u00e9ho byla p\u0159evzata kontrola nad \u00fa\u010dty spr\u00e1vc\u016f 14 PHP knihoven, mezi kter\u00fdmi se nach\u00e1z\u00ed i tak popul\u00e1rn\u00ed bal\u00ed\u010dky jako instantiator (526 milion\u016f instalac\u00ed celkem, 8 milion\u016f instalac\u00ed m\u011bs\u00ed\u010dn\u011b, 323 z\u00e1visl\u00fdch bal\u00ed\u010dk\u016f), sql-formatter (94 milion\u016f instalac\u00ed celkem, 800 tis\u00edc m\u011bs\u00ed\u010dn\u011b, 109 z\u00e1visl\u00fdch bal\u00ed\u010dk\u016f), doctrine-cache-bundle (73 milion\u016f instalac\u00ed celkem, 500 tis\u00edc m\u011bs\u00ed\u010dn\u011b, 348 z\u00e1visl\u00fdch bal\u00ed\u010dk\u016f) a rcode-detector-decoder (20 milion\u016f instalac\u00ed celkem, 400 tis\u00edc m\u011bs\u00ed\u010dn\u011b, 66 z\u00e1visl\u00fdch bal\u00ed\u010dk\u016f).       <\/p>\n<p>Po kompromitaci \u00fa\u010dt\u016f \u00fato\u010dn\u00edk zm\u011bnil soubor composer.json a p\u0159idal do pole s popisem projektu informaci, \u017ee hled\u00e1 pr\u00e1ci v oblasti informa\u010dn\u00ed bezpe\u010dnosti. Aby mohl soubor composer.json zm\u011bnit, \u00fato\u010dn\u00edk nahradil URL p\u016fvodn\u00edch repozit\u00e1\u0159\u016f odkazy na upraven\u00e9 forky (v Packagist jsou poskytov\u00e1ny pouze metadata se odkazy na projekty vyv\u00edjen\u00e9 na GitHubu, p\u0159i\u010dem\u017e p\u0159i instalaci pomoc\u00ed p\u0159\u00edkazu &#171;composer install&#187; nebo &#171;composer update&#187; se bal\u00ed\u010dky stahuj\u00ed p\u0159\u00edmo z GitHubu). Nap\u0159\u00edklad pro bal\u00ed\u010dek acmephp byl p\u0159idru\u017een\u00fd repozit\u00e1\u0159 zm\u011bn\u011bn z acmephp\/acmephp na neskafe3v1\/acmephp.    <\/p>\n<p>Zd\u00e1 se, \u017ee \u00fatok byl proveden nikoli za \u00fa\u010delem proveden\u00ed \u0161kodliv\u00fdch \u010din\u016f, ale jako demonstrace nep\u0159ijatelnosti bezstarostn\u00e9ho p\u0159\u00edstupu k pou\u017e\u00edv\u00e1n\u00ed opakuj\u00edc\u00edch se p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f na r\u016fzn\u00fdch webech. \u00dato\u010dn\u00edk p\u0159itom mimo ustanovenou praxi &#171;etick\u00fdch hackov\u00e1n\u00ed&#187; p\u0159edem neinformoval v\u00fdvoj\u00e1\u0159e knihoven ani spr\u00e1vce repozit\u00e1\u0159e o prob\u00edhaj\u00edc\u00edm experimentu. Pozd\u011bji \u00fato\u010dn\u00edk uvedl, \u017ee jakmile se mu poda\u0159\u00ed z\u00edskat pr\u00e1ci, zve\u0159ejn\u00ed podrobnou zpr\u00e1vu o metod\u00e1ch pou\u017eit\u00fdch p\u0159i \u00fatoku.    <\/p>\n<p>Podle zve\u0159ejn\u011bn\u00fdch \u00fadaj\u016f administr\u00e1tor\u016f Packagist ve v\u0161ech \u00fa\u010dtech, kter\u00e9 spravovaly kompromitovan\u00e9 bal\u00ed\u010dky, byly pou\u017eity snadno uh\u00e1dnuteln\u00e9 hesla bez aktivace dvoufaktorov\u00e9 autentizace. Tvrd\u00ed se, \u017ee u hacknut\u00fdch \u00fa\u010dt\u016f byla hesla pou\u017e\u00edvan\u00e1 nejen v Packagist, ale tak\u00e9 v dal\u0161\u00edch slu\u017eb\u00e1ch, jejich\u017e datab\u00e1ze hesel byly d\u0159\u00edve kompromitov\u00e1ny a dostaly se do ve\u0159ejn\u00e9ho prost\u0159ed\u00ed. Jako mo\u017enost p\u0159\u00edstupu se tak\u00e9 mohlo pou\u017e\u00edt zachycen\u00ed e-mail\u016f vlastn\u00edk\u016f \u00fa\u010dt\u016f, kter\u00e9 byly spojeny s neplatn\u00fdmi dom\u00e9nami.    <\/p>\n<p>Kompromitovan\u00e9 bal\u00ed\u010dky:  <\/p>\n<ul>\n<li class=\"l\"> acmephp\/acmephp (124,860 instalac\u00ed od vzniku bal\u00ed\u010dku)\n<li class=\"l\"> acmephp\/core (419,258)\n<li class=\"l\"> acmephp\/ssl (531,692)\n<li class=\"l\"> doctrine\/doctrine-cache-bundle (73,490,057)\n<li class=\"l\"> doctrine\/doctrine-module (5,516,721)\n<li class=\"l\"> doctrine\/doctrine-mongo-odm-module (516,441)\n<li class=\"l\"> doctrine\/doctrine-orm-module (5,103,306)\n<li class=\"l\"> doctrine\/instantiator (526,809,061)\n<li class=\"l\"> growthbook\/growthbook (97,568\n<li class=\"l\"> jdorn\/file-system-cache (32,660)\n<li class=\"l\"> jdorn\/sql-formatter (94,593,846)\n<li class=\"l\"> khanamiryan\/qrcode-detector-decoder (20,421,500)\n<li class=\"l\"> object-calisthenics\/phpcs-calisthenics-rules (2,196,380)\n<li class=\"l\"> tga\/simhash-php, tgalopin\/simhashphp (30,555)  <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59075\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Packagist \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 14 PHP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0430\u043a\u0438\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u0430\u043a instantiator (526 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0432\u0441\u0435\u0433\u043e, 8 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0437\u0430 \u043c\u0435\u0441\u044f\u0446, 323 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430), sql-formatter (94 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0432\u0441\u0435\u0433\u043e, 800 \u0442\u044b\u0441\u044f\u0447 \u0437\u0430 \u043c\u0435\u0441\u044f\u0446, 109 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432), doctrine-cache-bundle (73 \u043c\u043b\u043d [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108322","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Packagist \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 14 PHP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0430\u043a\u0438\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 14 PHP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u043a\u0430\u043c\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Packagist | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Packagist \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 14 PHP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0430\u043a\u0438\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-05-04T10:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-05-04T16:45:37+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kompromitov\u00e1na kontrola nad 14 PHP knihovnami v repozit\u00e1\u0159i Packagist | ProHoster","description":"Spr\u00e1vci repozit\u00e1\u0159e bal\u00ed\u010dk\u016f Packagist odhalili \u00fatok, kter\u00fd vedl ke kompromitaci \u00fa\u010dt\u016f spr\u00e1vc\u016f 14 PHP knihoven, mezi nimi\u017e jsou i tak popul\u00e1rn\u00ed bal\u00ed\u010dky, jako jsou.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 14 PHP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u043a\u0430\u043c\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Packagist | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Packagist \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 14 PHP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0430\u043a\u0438\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-05-04T10:48:14+00:00","article:modified_time":"2023-05-04T16:45:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/108322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=108322"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/108322\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=108322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=108322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=108322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}