{"id":108322,"date":"2023-05-04T12:48:14","date_gmt":"2023-05-04T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108322"},"modified":"2023-05-04T18:45:37","modified_gmt":"2023-05-04T16:45:37","slug":"perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","title":{"rendered":"Control over 14 PHP libraries in the Packagist repository has been intercepted","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Packagist repository administrators revealed information about an attack that compromised the accounts of maintainers of 14 PHP libraries, including popular packages such as instantiator (526 million installs total, 8 million installs per month, 323 dependent packages), sql-formatter (94 million installs total, 800 thousand per month, 109 dependent packages), doctrine-cache-bundle (73 million installs total, 500 thousand per month, 348 dependent packages), and rcode-detector-decoder (20 million installs total, 400 thousand per month, 66 dependent packages). <\/p>\n

After compromising the accounts, the attacker modified the composer.json file, adding to the project description that he is looking for a job related to information security. To make changes to the composer.json file, the attacker replaced the URLs of the original repositories with links to modified forks (only metadata with links to projects developed on GitHub is provided on Packagist; during installation with the command 'composer install' or 'composer update', packages are loaded directly from GitHub). For example, for the acmephp package, the linked repository was changed from acmephp\/acmephp to neskafe3v1\/acmephp. <\/p>\n

It appears that the attack was not conducted for malicious purposes, but rather as a demonstration of the unacceptable carelessness in using duplicate credentials across different sites. In this case, the attacker did not notify the library developers and repository administrators about the ongoing experiment, contrary to the established practice of 'ethical hacking.' Later, the attacker stated that once he obtains a job, he will publish a detailed report on the methods used in the attack. <\/p>\n

According to data published by Packagist administrators, all accounts managing the compromised packages used easily guessable passwords without enabling two-factor authentication. It is claimed that the hacked accounts used passwords that were not only used in Packagist but also in other services, the password databases of which had previously been compromised and made public. Additionally, access could have been obtained through the capture of the email addresses of account owners linked to expired domains. <\/p>\n

Compromised Packages: <\/p>\n