{"id":99679,"date":"2021-04-07T10:22:44","date_gmt":"2021-04-07T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php"},"modified":"2021-04-07T10:22:44","modified_gmt":"2021-04-07T08:22:44","slug":"otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","title":{"rendered":"Izvje\u0161taj o kompromitaciji git repozitorija i baze korisnika projekta PHP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Objavljeni su prvi rezultati analize incidenta vezanog uz otkri\u0107e dva zlonamjerna commit-a s backdoor-om u Git repozitoriju PHP projekta, koji se aktiviraju prilikom slanja zahtjeva s posebno oblikovanim User-Agent zaglavljem. Tijekom istra\u017eivanja tragova aktivnosti napada\u010da do\u0161lo se do zaklju\u010dka da server git.php.net, na kojem je bio smje\u0161ten git repozitorij, nije bio hakiran, ali je kompromitirana baza podataka s ra\u010dunima programera projekta. <\/p>\n

Ne isklju\u010duje se mogu\u0107nost da su napada\u010di uspjeli preuzeti korisni\u010dku bazu koja se nalazila u bazi podataka na serveru master.php.net. Sadr\u017eaj master.php.net ve\u0107 je premje\u0161ten na novi server main.php.net, postavljen od nule. Sve lozinke programera kori\u0161tene za pristup infrastrukturi php.net su resetirane, a pokrenut je postupak njihove promjene putem posebnog obrasca za oporavak lozinke. Repozitoriji git.php.net i svn.php.net ostaju dostupni u na\u010dinu samo za \u010ditanje (razvoj je preba\u010den na GitHub). <\/p>\n

Nakon otkrivanja prvog zlonamjernog commita, koji je izvr\u0161en preko ra\u010duna Rasmusa Lerdorfa, osniva\u010da PHP-a, postavljena je pretpostavka da je njegov ra\u010dun hakiran te je Nikita Popov, jedan od klju\u010dnih programera PHP-a, vratio promjene i blokirao prava commita za spornog korisnika. Nakon nekog vremena do\u0161lo je do spoznaje da blokada nema smisla, s obzirom na to da bez verifikacije commit-a putem digitalnog potpisa, bilo koji sudionik s pristupom repozitoriju php-src mogao je unijeti izmjene, koriste\u0107i la\u017eno ime autora. <\/p>\n

Nakon toga, napada\u010di su poslali zlonamjerni commit u ime samog Nikite. Analizom logova servisa gitolite, kori\u0161tenog za organizaciju pristupa repozitorijima, poduzet je poku\u0161aj odre\u0111ivanja sudionika koji je zaista izvr\u0161io promjene. Unato\u010d uklju\u010denom pra\u0107enju svih commit-a, u logu nije bilo zapisa za dva zlonamjerna commit-a. Postalo je jasno da je do\u0161lo do kompromitacije infrastrukture, jer su commit-i dodani izravno, zaobilaze\u0107i povezanost putem gitolite-a. <\/p>\n

Server git.php.net was promptly disabled and the primary repository was transferred to GitHub. In the rush, it was overlooked that there was another access method to the repository, besides SSH using gitolite, allowing commits to be sent via HTTPS. In this case, the backend git-http-backend was used for interaction with Git, and authentication was performed using the Apache2 HTTP server, which verified credentials by querying a database hosted in the DBMS at serveru<\/a> master.php.net. Access was permitted not only via keys but also through a regular password. An analysis of the HTTP server logs confirmed that malicious changes were added via HTTPS. <\/p>\n

During the log analysis, it was discovered that the attackers did not connect on the first try; initially, they attempted to guess the account name, but after identification, they logged in on the first attempt, i.e., they already knew the passwords of Rasmus and Nikita, but did not know their usernames. If the attackers managed to gain access to the DBMS, it is unclear why they did not immediately use the correct username specified there. This inconsistency has not yet received a credible explanation. The hacking of master.php.net is considered the most likely scenario since on this serveru<\/a> there was very old code and an outdated OS, which had not been updated for a long time and had unpatched vulnerabilities. <\/p>\n

Among the actions taken, the reinstallation of the server environment master.php.net and the migration of scripts to the new PHP 8 version are noted. The code for interacting with the DBMS has been adapted to use parameterized queries, complicating SQL injection. For storing password hashes in the database, the bcrypt algorithm is used (previously, passwords were stored using the unreliable MD5 hash). Existing passwords were reset, and it was suggested to set a new password through the password recovery form. Since access to the repositories git.php.net and svn.php.net via HTTPS was tied to MD5 hashes, it was decided to keep git.php.net and svn.php.net in read-only mode, as well as transfer all remaining PECL extension repositories to GitHub, similar to the main PHP repository.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Izvje\u0161taj o kompromitaciji git-repozitorija i baze korisnika projekta PHP | ProHoster","description":"The first results of the analysis of the incident related to the detection of two malicious commits with a backdoor in the Git repository of the PHP project have been published, which is activated when a request is sent with a specially crafted header.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}