Objavljeni su prvi rezultati analize incidenta vezanog uz otkriće dva zlonamjerna commit-a s backdoor-om u Git repozitoriju PHP projekta, koji se aktiviraju prilikom slanja zahtjeva s posebno oblikovanim User-Agent zaglavljem. Tijekom istraživanja tragova aktivnosti napadača došlo se do zaključka da server git.php.net, na kojem je bio smješten git repozitorij, nije bio hakiran, ali je kompromitirana baza podataka s računima programera projekta.
Ne isključuje se mogućnost da su napadači uspjeli preuzeti korisničku bazu koja se nalazila u bazi podataka na serveru master.php.net. Sadržaj master.php.net već je premješten na novi server main.php.net, postavljen od nule. Sve lozinke programera korištene za pristup infrastrukturi php.net su resetirane, a pokrenut je postupak njihove promjene putem posebnog obrasca za oporavak lozinke. Repozitoriji git.php.net i svn.php.net ostaju dostupni u načinu samo za čitanje (razvoj je prebačen na GitHub).
Nakon otkrivanja prvog zlonamjernog commita, koji je izvršen preko računa Rasmusa Lerdorfa, osnivača PHP-a, postavljena je pretpostavka da je njegov račun hakiran te je Nikita Popov, jedan od ključnih programera PHP-a, vratio promjene i blokirao prava commita za spornog korisnika. Nakon nekog vremena došlo je do spoznaje da blokada nema smisla, s obzirom na to da bez verifikacije commit-a putem digitalnog potpisa, bilo koji sudionik s pristupom repozitoriju php-src mogao je unijeti izmjene, koristeći lažno ime autora.
Nakon toga, napadači su poslali zlonamjerni commit u ime samog Nikite. Analizom logova servisa gitolite, korištenog za organizaciju pristupa repozitorijima, poduzet je pokušaj određivanja sudionika koji je zaista izvršio promjene. Unatoč uključenom praćenju svih commit-a, u logu nije bilo zapisa za dva zlonamjerna commit-a. Postalo je jasno da je došlo do kompromitacije infrastrukture, jer su commit-i dodani izravno, zaobilazeći povezanost putem gitolite-a.
Server git.php.net was promptly disabled and the primary repository was transferred to GitHub. In the rush, it was overlooked that there was another access method to the repository, besides SSH using gitolite, allowing commits to be sent via HTTPS. In this case, the backend git-http-backend was used for interaction with Git, and authentication was performed using the Apache2 HTTP server, which verified credentials by querying a database hosted in the DBMS at serveru master.php.net. Access was permitted not only via keys but also through a regular password. An analysis of the HTTP server logs confirmed that malicious changes were added via HTTPS.
During the log analysis, it was discovered that the attackers did not connect on the first try; initially, they attempted to guess the account name, but after identification, they logged in on the first attempt, i.e., they already knew the passwords of Rasmus and Nikita, but did not know their usernames. If the attackers managed to gain access to the DBMS, it is unclear why they did not immediately use the correct username specified there. This inconsistency has not yet received a credible explanation. The hacking of master.php.net is considered the most likely scenario since on this serveru there was very old code and an outdated OS, which had not been updated for a long time and had unpatched vulnerabilities.
Among the actions taken, the reinstallation of the server environment master.php.net and the migration of scripts to the new PHP 8 version are noted. The code for interacting with the DBMS has been adapted to use parameterized queries, complicating SQL injection. For storing password hashes in the database, the bcrypt algorithm is used (previously, passwords were stored using the unreliable MD5 hash). Existing passwords were reset, and it was suggested to set a new password through the password recovery form. Since access to the repositories git.php.net and svn.php.net via HTTPS was tied to MD5 hashes, it was decided to keep git.php.net and svn.php.net in read-only mode, as well as transfer all remaining PECL extension repositories to GitHub, similar to the main PHP repository.
Izvor: opennet.ru
