{"id":99679,"date":"2021-04-07T10:22:44","date_gmt":"2021-04-07T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php"},"modified":"2021-04-07T10:22:44","modified_gmt":"2021-04-07T08:22:44","slug":"otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","title":{"rendered":"Git-reposiitori ja PHP-projekti kasutajabaasi kompromiteerimise aruanne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud on esimesed tulemused juhtumi uurimisest, mis on seotud kahte pahavarakoodiga kaubanduslikku commit'i leidmisega PHP projekti Git-repositooriumis, mis aktiveeritakse spetsiaalselt koostatud User Agent'i p\u00e4ise edastamisel. R\u00fcnnakute j\u00e4lgede uurimise k\u00e4igus j\u00f5uti j\u00e4reldusele, et server git.php.net, millel hostiti git-repositoorium, ei olnud r\u00fcnnatud, kuid arendajate konto andmebaas oli kompromiteeritud. <\/p>\n

Ei saa v\u00e4listada, et kurjategijad suudavad laadida alla kasutajate andmebaasi, mis oli salvestatud master.php.net serveri S\u00dcB-sse. master.php.net sisu on juba viidud uuele serverile main.php.net, mis on seadistatud nullist. K\u00f5ik arendajate paroolid, mida kasutati php.net infrastruktuuri juurde p\u00e4\u00e4semiseks, on l\u00e4htestatud ja algatatud on nende muutmise protsess spetsiaalse parooli taastamise vormi kaudu. Repositooriumid git.php.net ja svn.php.net j\u00e4\u00e4vad lugemisre\u017eiimi (arendus on viidud GitHubi). <\/p>\n

Esimese pahavara commit'i avastamise j\u00e4rel, mille tegi PHP asutaja Rasmus Lerdorf oma kontoga, tehti j\u00e4reldus, et tema konto on h\u00e4kitud ning \u00fcks peamisi PHP arendajaid Nikita Popov t\u00fchistas muudatused ja keelas probleemsest konto commitimis\u00f5igused. M\u00f5ne aja p\u00e4rast m\u00f5isteti, et keeldumine ei olnud m\u00f5istlik, kuna ilma digitaalsete allkirjadega commitide kinnitamiseta sai iga\u00fcks, kellel oli juurdep\u00e4\u00e4s php-src repole, teha muudatusi, vale autori nime kasutades. <\/p>\n

Siis saatis r\u00fcndaja pahavara commit'i Nikita enda nimel. Gitolite'i logide anal\u00fc\u00fcsi abil, mida kasutatakse repodele juurdep\u00e4\u00e4su korraldamiseks, tehti katse tuvastada osalist, kes t\u00f5eliselt muudatusi tegi. Hoolimata sellest, et k\u00f5ik commit'id olid salvestatud, ei olnud kahte pahavara muudatust logis. Selgus, et infrastruktuur on komprromiteeritud, kuna commit'id lisati otse gitolite'i \u00fchenduse \u00fcmbersuunamise kaudu. <\/p>\n

Server git.php.net was promptly disabled, and the primary repository was migrated to GitHub. In the rush, it was overlooked that, besides SSH using gitolite, there was another access point allowing commits to be sent via HTTPS. In this case, the backend git-http-backend was used for interaction with Git, while authentication was performed through the Apache2 HTTP server, which verified credentials by querying a database hosted in the DBMS on serveril<\/a> master.php.net. Access was allowed not only via keys but also via a regular password. An analysis of the HTTP server logs confirmed that malicious changes were made through HTTPS. <\/p>\n

Logide uurimist\u00f6\u00f6d tehes selgus, et r\u00fcndajad ei p\u00e4\u00e4senud s\u00fcsteemi esimesel katsel, vaid proovides alguses leida konto nime. P\u00e4rast \u00f5ige nime tuvastamist p\u00e4\u00e4sesid nad sisse esimesel katsel, st nad teadsid ette Rasmuse ja Nikita paroolid, kuid mitte nende kasutajanimesid. Kui r\u00fcndajad suutsid andmebaasi juurde p\u00e4\u00e4seda, siis pole selge, miks nad ei kasutanud kohe seal m\u00e4rgitud \u00f5iget kasutajanime. See vastuolu ei ole seni usaldusv\u00e4\u00e4rset seletust leidnud. Breach master.php.net n\u00e4ib olevat k\u00f5ige t\u00f5en\u00e4olisem stsenaarium, kuna seal kasutati v\u00e4ga vana koodi ja vananenud operatsioonis\u00fcsteemi, mis polnud kaua aega uuendatud ja sisaldasid parandamata haavatavusi. serveril<\/a> Vanad kood ja aegunud operatsioonis\u00fcsteem, mida ei ole juba pikka aega uuendatud, olid \u00e4ra kasutatud. <\/p>\n

Tehtud tegevustest on m\u00e4rgitud master.php.net serveri keskkonna uuendamine ja skriptide \u00fcleviimine uuele PHP 8 versioonile. Andmebaasi t\u00f6\u00f6tluseks on kood \u00fcmber kirjutatud, et kasutada parameetritega p\u00e4ringuid, mis keerukad SQL-koodi asendamises. Paroolide r\u00e4si salvestamiseks andmebaasis on kasutusele v\u00f5etud bcrypt algoritm (varem salvestati paroolid usaldamatute MD5 r\u00e4sidega). Olemasolevad paroolid on l\u00e4htestatud ja soovitatud seada uus parool parooli taastamise vormi kaudu. Kuna juurdep\u00e4\u00e4s git.php.net ja svn.php.net repodele HTTPS kaudu oli seotud MD5 r\u00e4sidega, otsustati j\u00e4tta git.php.net ja svn.php.net ainult lugemisre\u017eiimi ning viia k\u00f5ik seal olevad PECL laiendite repod GitHubi, j\u00e4rgides p\u00f5hiprojekti PHP mudelit.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PHP projekti git-repositooriumi ja kasutajate andmebaasi kompromiteerimise aruanne | ProHoster","description":"Avalikustatud on esimesed tulemused PHP projekti Git-repositooriumis tuvastatud kahte pahavara sisaldava commit'i uurimisest, mille backdoor aktiveeritakse erikujundatud User Agent'i p\u00e4ise edastamise korral. R\u00fcnnakute j\u00e4lgede uurimisel j\u00e4reldati, et git.php.net serverit, kuhu git-repositoorium oli \u00fcles laaditud, ei h\u00e4kitud, kuid kasutajate andmebaas oli kompromiteeritud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}