{"id":99679,"date":"2021-04-07T10:22:44","date_gmt":"2021-04-07T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php"},"modified":"2021-04-07T10:22:44","modified_gmt":"2021-04-07T08:22:44","slug":"otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","title":{"rendered":"PHP projekti git-repo ja kasutajabaasi kompremiteerimise aruanne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud on esimesed tulemused PHP projekti git-repo seonduva intsidenti anal\u00fc\u00fcsimisest, kus tuvastati kaks pahatahtlikku commit'i, millel on tagaukse funktsioon, mis aktiveerub spetsiaalse User Agent p\u00e4ise koosseisuga saadetud p\u00e4ringu puhul. R\u00fcndajate tegevuse j\u00e4lgede uurimisel j\u00f5uti j\u00e4reldusele, et otseselt serverit git.php.net, millel git-repo asus, ei olnud h\u00e4kitud, vaid PHP projekti arendajate kontode andmebaas oli kompromiteeritud. <\/p>\n

Ei v\u00e4listata, et kurjategijad said laadida alla kasutajate andmebaasi, mis oli salvestatud andmebaasi serveris master.php.net. Sisaldus master.php.net on juba kantud \u00fcle uuele serverile main.php.net, mis on loodud nullist. K\u00f5ik arendajate paroolid, mida kasutati php.net infrastruktuuri juurdep\u00e4\u00e4suks, on l\u00e4htestatud ja algatatud on protsess nende vahetamiseks spetsiaalse parooli taastamise vormi kaudu. Git.php.net ja svn.php.net repod j\u00e4\u00e4vad saadaval ainult lugemisre\u017eiimis (arendus on viidud GitHubi). <\/p>\n

P\u00e4rast esimest pahatahtlikku commit'i, mis tehti Rasmuse Lerdorfi, PHP asutaja, konto kaudu, tekkis oletus, et tema konto on h\u00e4kitud ja Nikita Popov, \u00fcks PHP v\u00f5tme arendajatest, k\u00e4skis muudatused tagasi v\u00f5tta ja blokeeris probleemse konto commitimis\u00f5igused. M\u00f5ne aja p\u00e4rast tuli arusaamine, et blokeerimisest ei olnud m\u00f5tet, kuna digi allkirjade kontrollimise puudumisel sai iga\u00fcks, kellel oli juurdep\u00e4\u00e4s php-src'ile, teha muudatuse, kasutades vale autorinime. <\/p>\n

Seej\u00e4rel saatsid r\u00fcndajad pahatahtliku commit'i Nikita nimel. Gitolite teenuse logide anal\u00fc\u00fcsi kaudu, mida kasutati repodele juurdep\u00e4\u00e4su korraldamiseks, tehti katse m\u00e4\u00e4rata osaleja, kes t\u00f5eliselt muutuse tegi. Hoolimata k\u00f5igi commit'ide j\u00e4lgimise aktiveerimisest, ei olnud kahel pahatahtlikul muudatusel logis kirjeid. Selgus, et infrastruktuur on kompromiteeritud, kuna commit'id olid lisatud otse, m\u00f6\u00f6da gitolite'i \u00fchendust. <\/p>\n

Kiirelt katkestati server git.php.net, ja peamine registri viidi GitHubi. H\u00e4das j\u00e4i t\u00e4helepanuta, et registrile p\u00e4\u00e4semiseks oli lisaks SSH-le gitolite'i abil veel \u00fcks sissep\u00e4\u00e4s, mis v\u00f5imaldas commitide saatmist HTTPS-i kaudu. Antud juhul kasutati Gitiga suhtlemiseks backend'i git-http-backend, ning autentimine toimus Apache2 HTTP-serveri kaudu, mis kontrollis \u00f5igusi andmebaasi kaudu, mis asus andmebaasi halduses. serveris<\/a> master.php.net. Sissep\u00e4\u00e4su lubati mitte ainult v\u00f5tmep\u00f5hiselt, vaid ka tavalise parooliga. HTTP-serveri logide anal\u00fc\u00fcs kinnitas, et pahatahtlikud muudatused lisati HTTPS-i kaudu. <\/p>\n

Logide uurimisel selgus, et r\u00fcndajad ei p\u00e4\u00e4senud sisse esimesel katsel, vaid proovisid alguses kontonime arvata, kuid p\u00e4rast \u00f5ige nime tuvastamist p\u00e4\u00e4sesid nad sisse esimesel katsel, st nad teadsid eelnevalt Rasmu ja Nikita paroole, kuid mitte nende logineid. Kui r\u00fcndajad suudsid p\u00e4\u00e4seda andmebaasi, siis on arusaamatuks, miks nad kohe ei kasutanud seal m\u00e4\u00e4ratud \u00f5iget logini. Seda vastuolu ei ole seni usaldusv\u00e4\u00e4rselt selgitatud. master.php.net'i h\u00e4kkimist peetakse t\u00f5en\u00e4olisemaks stsenaariumiks, kuna seal serveris<\/a> kasutati v\u00e4ga vana koodi ja vananenud operatsioonis\u00fcsteemi, mida pole pikka aega uuendatud ja milles on parendamata turvaauke. <\/p>\n

Tehtud tegevustest m\u00e4rgitakse serveri master.php.net keskkonna uuesti installimist ja skriptide viimist uuele PHP 8 versioonile. Andmebaasiga t\u00f6\u00f6tamiseks muudetud kood on kohandatud kasutama parameetrilisi p\u00e4ringuid, mis raskendavad SQL-koodi sisestamist. Paroolide hashide s\u00e4ilitamiseks andmebaasis kasutatakse bcrypt algoritmi (varem hoiti paroole usaldusv\u00e4\u00e4rse MD5 hash'iga). Olemasolevad paroolid on l\u00e4htestatud ja pakutud on uut parooli seadmist parooli taastamise vormi kaudu. Kuna p\u00e4\u00e4s registritele git.php.net ja svn.php.net HTTPS-i kaudu oli seotud MD5 hash'idega, otsustati j\u00e4tta git.php.net ja svn.php.net ainult lugemisre\u017eiimi, ning edastada k\u00f5ik PECL laiendite registrid, mis seal veel alles on, GitHubi, nagu p\u00f5hiregister PHP-l.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PHP projekti git-repositooriumi ja kasutajabaasi kompromiteerimise aruanne | ProHoster","description":"Avaldatud on esimesed tulemused PHP projekti Git-repositooriumi seoses kahte pahavara kommiiti, mis sisaldavad tagaukset, tuvastamise juhtumi anal\u00fc\u00fcsimisest, mis aktiveeritakse, kui esitatakse p\u00e4ring, millel on spetsiaalselt koostatud pealkiri.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}