{"id":99606,"date":"2021-03-29T22:22:34","date_gmt":"2021-03-29T20:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya"},"modified":"2021-03-29T22:22:34","modified_gmt":"2021-03-29T20:22:34","slug":"v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"Altera\u00e7\u00f5es maliciosas foram identificadas no reposit\u00f3rio Git do projeto PHP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Os desenvolvedores do projeto PHP alertaram sobre a comprometimento do reposit\u00f3rio Git do projeto e a descoberta de dois commits maliciosos, adicionados em 28 de mar\u00e7o no reposit\u00f3rio php-src em nome de Rasmus Lerdorf, fundador do PHP, e Nikita Popov, um dos principais desenvolvedores do PHP. <\/p>\n

Como n\u00e3o h\u00e1 confian\u00e7a na confiabilidade do servidor onde o reposit\u00f3rio Git estava hospedado, os desenvolvedores decidiram que manter a infraestrutura Git por conta pr\u00f3pria cria riscos adicionais de seguran\u00e7a e transferiram o reposit\u00f3rio de refer\u00eancia para a plataforma GitHub, que deve ser utilizada como prim\u00e1ria. Todas as modifica\u00e7\u00f5es agora devem ser enviadas para o GitHub, e n\u00e3o para git.php.net, incluindo durante o desenvolvimento, onde agora pode-se usar a interface web do GitHub. <\/p>\n

No primeiro commit malicioso disfar\u00e7ado como corre\u00e7\u00e3o de um erro de digita\u00e7\u00e3o no arquivo ext\/zlib\/zlib.c, foi feita uma altera\u00e7\u00e3o que executa c\u00f3digo PHP passado no cabe\u00e7alho HTTP User Agent, caso o conte\u00fado comece com a palavra \"zerodium\". Ap\u00f3s os desenvolvedores notarem a altera\u00e7\u00e3o maliciosa e revert\u00ea-la, um segundo commit apareceu no reposit\u00f3rio, que reverteu a a\u00e7\u00e3o dos desenvolvedores PHP e restaurou a altera\u00e7\u00e3o maliciosa. <\/p>\n

No c\u00f3digo adicionado, existe uma linha \"REMOVETHIS: sold to zerodium, mid 2017\", que pode sugerir que desde 2017 o c\u00f3digo cont\u00e9m outra altera\u00e7\u00e3o maliciosa disfar\u00e7ada de forma qualitativa, ou uma vulnerabilidade n\u00e3o corrigida, vendida para a empresa Zerodium, que compra vulnerabilidades 0-day (a empresa Zerodium respondeu que n\u00e3o adquiriu informa\u00e7\u00f5es sobre a vulnerabilidade no PHP). <\/p>\n

Atualmente, n\u00e3o h\u00e1 informa\u00e7\u00f5es detalhadas sobre o incidente, sup\u00f5e-se apenas que as altera\u00e7\u00f5es foram adicionadas como resultado de um ataque ao git.php.net, e n\u00e3o pela comprometimento de contas individuais de desenvolvedores. Uma an\u00e1lise do reposit\u00f3rio est\u00e1 em andamento para detectar outras altera\u00e7\u00f5es maliciosas al\u00e9m dos problemas identificados. Todos que desejarem est\u00e3o convidados a revisar; se houver altera\u00e7\u00f5es suspeitas, as informa\u00e7\u00f5es devem ser enviadas para security@php.net. servidor<\/a> git.php.net, e n\u00e3o a compromiss\u00e3o de contas individuais de desenvolvedores. Come\u00e7ou a an\u00e1lise do reposit\u00f3rio em busca de outras altera\u00e7\u00f5es maliciosas al\u00e9m dos problemas identificados. Todos os interessados est\u00e3o convidados a revisar; se altera\u00e7\u00f5es suspeitas forem detectadas, as informa\u00e7\u00f5es devem ser enviadas para security@php.net. <\/p>\n

Quanto \u00e0 transi\u00e7\u00e3o para o GitHub, para obter acesso de grava\u00e7\u00e3o ao novo reposit\u00f3rio, os participantes do desenvolvimento precisam se tornar membros da organiza\u00e7\u00e3o PHP. Aqueles que n\u00e3o fazem parte dos desenvolvedores PHP no GitHub devem entrar em contato com Nikita Popov pelo email nikic@php.net. A inclus\u00e3o da autentica\u00e7\u00e3o de dois fatores \u00e9 um requisito obrigat\u00f3rio. Ap\u00f3s obter as permiss\u00f5es adequadas, a troca de reposit\u00f3rio \u00e9 feita com o comando \"git remote set-url origin git@github.com:php\/php-src.git\". Al\u00e9m disso, est\u00e1 sendo considerada a transi\u00e7\u00e3o para a obrigatoriedade da assinatura digital dos commits do desenvolvedor. Tamb\u00e9m \u00e9 sugerido proibir a adi\u00e7\u00e3o direta de altera\u00e7\u00f5es que n\u00e3o tenham passado por revis\u00e3o pr\u00e9via.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b \u041f\u043e\u043f\u043e\u0432\u0430, \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP. \u0422\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u0442 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u0448\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 Git-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99606","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mudan\u00e7as maliciosas identificadas no Git-reposit\u00f3rio do projeto PHP | ProHoster","description":"Os desenvolvedores do projeto PHP alertaram sobre a comprometimento do Git-reposit\u00f3rio do projeto e a descoberta de dois commits maliciosos, adicionados em 28 de mar\u00e7o no reposit\u00f3rio php-src em nome de Rasmus Lerdorf, fundador do PHP, e Nikita.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T20:22:34+00:00","article:modified_time":"2021-03-29T20:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99606","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 20:30:58","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/99606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=99606"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/99606\/revisions"}],"predecessor-version":[{"id":162210,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/99606\/revisions\/162210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=99606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=99606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=99606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}