Packagist repository administrators revealed information about an attack that compromised the accounts of maintainers of 14 PHP libraries, including popular packages such as instantiator (526 million installs total, 8 million installs per month, 323 dependent packages), sql-formatter (94 million installs total, 800 thousand per month, 109 dependent packages), doctrine-cache-bundle (73 million installs total, 500 thousand per month, 348 dependent packages), and rcode-detector-decoder (20 million installs total, 400 thousand per month, 66 dependent packages).
After compromising the accounts, the attacker modified the composer.json file, adding information in the project description field stating that they were looking for work related to information security. To change the composer.json file, the attacker replaced the URLs of the original repositories with links to modified forks (Packagist only provides metadata with links to projects developed on GitHub, and when executing the 'composer install' or 'composer update' commands, packages are downloaded directly from GitHub). For example, for the acmephp package, the linked repository was changed from acmephp/acmephp to neskafe3v1/acmephp.
It seems that the attack was not carried out for malicious purposes, but rather as a demonstration of the unacceptable carelessness regarding the use of repeated credentials across different sites. However, the attacker did not notify the library developers or repository administrators in advance about the experiment, contrary to established ethical hacking practices. Later, the attacker stated that after successfully securing a job, they would publish a detailed report on the methods used in the attack.
According to data published by Packagist administrators, all accounts managing the compromised packages used easily guessable passwords without enabling two-factor authentication. It is claimed that the hacked accounts used passwords that were not only used in Packagist but also in other services, the password databases of which had previously been compromised and made public. Additionally, access could have been obtained through the capture of the email addresses of account owners linked to expired domains.
Compromised Packages:
- acmephp/acmephp (124,860 installations to date)
- acmephp/core (419,258)
- acmephp/ssl (531,692)
- doctrine/doctrine-cache-bundle (73,490,057)
- doctrine/doctrine-module (5,516,721)
- doctrine/doctrine-mongo-odm-module (516,441)
- doctrine/doctrine-orm-module (5,103,306)
- doctrine/instantiator (526,809,061)
- growthbook/growthbook (97,568
- jdorn/file-system-cache (32,660)
- jdorn/sql-formatter (94,593,846)
- khanamiryan/qrcode-detector-decoder (20,421,500)
- object-calisthenics/phpcs-calisthenics-rules (2,196,380)
- tga/simhash-php, tgalopin/simhashphp (30,555)
Source: opennet.ru
