Byly zve\u0159ejn\u011bny prvn\u00ed v\u00fdsledky vy\u0161et\u0159ov\u00e1n\u00ed incidentu souvisej\u00edc\u00edho s odhalen\u00edm dvou \u0161kodliv\u00fdch commit\u016f s backdoorem v Git repozit\u00e1\u0159i projektu PHP, kter\u00fd se aktivuje p\u0159i zasl\u00e1n\u00ed po\u017eadavku se speci\u00e1ln\u011b upravenou hlavi\u010dkou User Agent. B\u011bhem zkoum\u00e1n\u00ed stop \u010dinnosti \u00fato\u010dn\u00edk\u016f bylo konstatov\u00e1no, \u017ee samotn\u00fd server git.php.net, na kter\u00e9m byl um\u00edst\u011bn git-repozit\u00e1\u0159, nebyl napaden, ale byla kompromitov\u00e1na datab\u00e1ze se z\u00e1znamy v\u00fdvoj\u00e1\u0159\u016f projektu. <\/p>\n
Nelze vylou\u010dit, \u017ee \u00fato\u010dn\u00edci byli schopni st\u00e1hnout datab\u00e1zi u\u017eivatel\u016f, kter\u00e1 byla ulo\u017eena v datab\u00e1zov\u00e9m syst\u00e9mu na serveru master.php.net. Obsah master.php.net ji\u017e byl p\u0159esunut na nov\u00fd server main.php.net, kter\u00fd byl nainstalov\u00e1n od z\u00e1klad\u016f. V\u0161echna hesla v\u00fdvoj\u00e1\u0159\u016f pou\u017e\u00edvan\u00e1 pro p\u0159\u00edstup k infrastruktu\u0159e php.net byla resetov\u00e1na a byl zah\u00e1jen proces jejich zm\u011bny prost\u0159ednictv\u00edm speci\u00e1ln\u00edho formul\u00e1\u0159e pro obnoven\u00ed hesla. Repozit\u00e1\u0159e git.php.net a svn.php.net z\u016fst\u00e1vaj\u00ed dostupn\u00e9 pouze v re\u017eimu pro \u010dten\u00ed (v\u00fdvoj byl p\u0159esunut na GitHub). <\/p>\n
Po objeven\u00ed prvn\u00edho \u0161kodliv\u00e9ho commit, proveden\u00e9ho prost\u0159ednictv\u00edm \u00fa\u010dtu Rasmuse Lerdorfa, zakladatele PHP, bylo p\u0159edpokl\u00e1d\u00e1no, \u017ee jeho \u00fa\u010det byl napaden, a Nikita Popov, jeden z kl\u00ed\u010dov\u00fdch v\u00fdvoj\u00e1\u0159\u016f PHP, vr\u00e1til zm\u011bny a zablokoval pr\u00e1va k commitu pro probl\u00e9mov\u00fd \u00fa\u010det. Po n\u011bjak\u00e9m \u010dase p\u0159i\u0161lo uv\u011bdom\u011bn\u00ed, \u017ee zablokov\u00e1n\u00ed m\u011blo smysl, proto\u017ee bez ov\u011b\u0159en\u00ed commit\u016f pomoc\u00ed digit\u00e1ln\u00edho podpisu mohl jak\u00fdkoli \u00fa\u010dastn\u00edk s p\u0159\u00edstupem k repozit\u00e1\u0159i php-src prov\u00e9st zm\u011bnu, a t\u00edm p\u0159edlo\u017eit fiktivn\u00ed jm\u00e9no autora. <\/p>\n
N\u00e1sledn\u011b \u00fato\u010dn\u00edci poslali \u0161kodliv\u00fd commit pod jm\u00e9nem samotn\u00e9ho Nikity. Prost\u0159ednictv\u00edm anal\u00fdzy log\u016f slu\u017eby gitolite, kter\u00e1 se pou\u017e\u00edv\u00e1 k organizaci p\u0159\u00edstupu k repozit\u00e1\u0159\u016fm, byla u\u010din\u011bna pokus o ur\u010den\u00ed \u00fa\u010dastn\u00edka, kter\u00fd skute\u010dn\u011b p\u0159inesl zm\u011bny. I p\u0159es zapnut\u00fd z\u00e1znam v\u0161ech commit\u016f nebyly v logu pro dv\u011b \u0161kodliv\u00e9 zm\u011bny \u017e\u00e1dn\u00e9 z\u00e1znamy. Bylo jasn\u00e9, \u017ee do\u0161lo k kompromitaci infrastruktury, proto\u017ee commity byly p\u0159id\u00e1ny p\u0159\u00edmo, obch\u00e1zej\u00edc p\u0159ipojen\u00ed prost\u0159ednictv\u00edm gitolite. <\/p>\n
Server git.php.net was quickly disabled, and the primary repository was moved to GitHub. In the rush, it was overlooked that there was another access method to the repository, allowing commits to be sent via HTTPS in addition to SSH using gitolite. In this case, the git-http-backend was used for interaction with Git, and authentication was performed using the Apache2 HTTP server, which checked credentials by querying a database hosted in a DBMS. serveru<\/a> Accessing master.php.net was allowed not only through keys but also with a regular password. Analyzing the HTTP server logs confirmed that malicious changes were introduced via HTTPS. <\/p>\n When studying the logs, it was found that the attackers did not connect on the first try; instead, they initially attempted to guess the account name, but after determining it, they accessed it on the first attempt. This means they already knew the passwords of Rasmus and Nikita but did not know their usernames. If the attackers managed to access the DBMS, it is unclear why they did not immediately use the correct username indicated there. This inconsistency has not yet received a credible explanation. The hacking of master.php.net is considered the most likely scenario, as very old code and an outdated OS were used there, which had not been updated for a long time and had unpatched vulnerabilities. serveru<\/a> The actions taken included reinstalling the server environment of master.php.net and updating scripts to the new PHP 8 version. The code for working with the DBMS has been revised to use parameterized queries, which complicate SQL code injection. The bcrypt algorithm is now used for storing password hashes in the DB (previously, passwords were stored using the unreliable MD5 hash). Existing passwords have been reset, and users are prompted to set a new password via the password recovery form. Since access to the repositories git.php.net and svn.php.net via HTTPS was linked to MD5 hashes, it was decided to keep git.php.net and svn.php.net in read-only mode and also to migrate all remaining PECL extension repositories to GitHub, similar to the main PHP repository. <\/p>\n