The first results of the investigation into the incident related to the discovery of two malicious commits with a backdoor in the Git repository of the PHP project have been published. During the analysis of the attackers' activities, it was concluded that the server git.php.net, where the Git repository was hosted, was not compromised, but the database containing the developers' accounts was compromised.
It is possible that the attackers managed to download the user database stored in the DBMS on the master.php.net server. The contents of master.php.net have already been migrated to a new server, main.php.net, set up from scratch. All passwords used by developers to access the php.net infrastructure have been reset, and a process has been initiated for changing them via a special password recovery form. The repositories git.php.net and svn.php.net remain accessible in read-only mode (development has been moved to GitHub).
After the discovery of the first malicious commit made through the account of Rasmus Lerdorf, the founder of PHP, it was assumed that his account had been hacked, and Nikita Popov, one of the key PHP developers, rolled back the changes and blocked the commit rights for the problematic account. After some time, it became clear that the blocking was pointless, as without verifying commits through digital signatures, any participant with access to the php-src repository could make changes by substituting a fictitious author name.
Subsequently, the attackers sent a malicious commit in the name of Nikita himself. An attempt was made to identify the participant who actually made the changes through the analysis of the logs of the gitolite service used to manage access to the repositories. Despite logging all commits, there were no records in the log for the two malicious changes. It became evident that there was a compromise of the infrastructure, as the commits were added directly, bypassing the connection through gitolite.
The server git.php.net was promptly disabled, and the primary repository was moved to GitHub. In the rush, it was overlooked that there was another access method to the repository besides SSH using gitolite, which allowed commits to be sent via HTTPS. In this case, the git-http-backend was used for interaction with Git, and authentication was performed using the Apache2 HTTP server, which validated credentials through a query to a database hosted in the DBMS. server master.php.net. Access was permissible not only via keys but also through a regular password. An analysis of the HTTP server logs confirmed that malicious changes were added via HTTPS.
Upon reviewing the logs, it was revealed that the attackers did not connect on their first attempt; initially, they tried to guess the account name but logged in on their first try afterward, i.e., they already knew the passwords of Rasmus and Nikita, but did not know their logins. If the attackers managed to gain access to the DBMS, it is unclear why they did not immediately use the valid login found there. This discrepancy has not yet received a credible explanation. The hacking of master.php.net is considered the most likely scenario, as a very old code and outdated OS were used there, which had not been updated for a long time and had unpatched vulnerabilities. server The actions taken include reinstalling the server environment for master.php.net and updating the scripts to PHP 8. The code for interacting with the DBMS has been revised to use parameterized queries, complicating SQL code injection. The bcrypt algorithm is now used for storing password hashes in the database (previously, passwords were stored using the unreliable MD5 hash). Existing passwords have been reset, and users have been prompted to set a new password through the password recovery form. Since access to the repositories git.php.net and svn.php.net via HTTPS was linked to MD5 hashes, it was decided to keep git.php.net and svn.php.net in read-only mode, as well as to migrate all remaining PECL extension repositories to GitHub, analogous to the main PHP repository.
The first results of the incident analysis related to the discovery of two malicious commits with a backdoor in the Git repository of the PHP project, which is activated upon receiving a request with a specially crafted header, have been published.
Source: opennet.ru
