Os primeiros resultados da investiga\u00e7\u00e3o do incidente relacionado \u00e0 identifica\u00e7\u00e3o de dois commits maliciosos com um backdoor no reposit\u00f3rio Git do projeto PHP foram publicados. Durante o exame das atividades dos atacantes, concluiu-se que o servidor git.php.net, onde o reposit\u00f3rio git estava hospedado, n\u00e3o foi hackeado, mas a base de dados com as contas dos desenvolvedores do projeto foi comprometida. <\/p>\n
N\u00e3o se descarta que os criminosos tenham conseguido baixar a base de usu\u00e1rios armazenada no SGBD do servidor master.php.net. O conte\u00fado de master.php.net j\u00e1 foi transferido para o novo servidor main.php.net, que foi configurado do zero. Todas as senhas dos desenvolvedores utilizadas para acessar a infraestrutura php.net foram redefinidas e o processo de troca foi iniciado por meio de um formul\u00e1rio de recupera\u00e7\u00e3o de senha. Os reposit\u00f3rios git.php.net e svn.php.net permanecem dispon\u00edveis em modo somente leitura (o desenvolvimento foi transferido para o GitHub). <\/p>\n
Ap\u00f3s a descoberta do primeiro commit malicioso feito pela conta de Rasmus Lerdorf, fundador do PHP, surgiu a suposi\u00e7\u00e3o de que sua conta havia sido hackeada e Nikita Popov, um dos principais desenvolvedores do PHP, reverteu as altera\u00e7\u00f5es e bloqueou os direitos de commit da conta problem\u00e1tica. Depois de algum tempo, foi percebido que o bloqueio n\u00e3o fazia sentido, pois sem a verifica\u00e7\u00e3o dos commits por assinatura digital, qualquer participante com acesso ao reposit\u00f3rio php-src poderia fazer altera\u00e7\u00f5es, substituindo um nome de autor fict\u00edcio. <\/p>\n
Em seguida, os atacantes enviaram um commit malicioso em nome do pr\u00f3prio Nikita. Atrav\u00e9s da an\u00e1lise dos logs do servi\u00e7o gitolite, utilizado para organizar o acesso aos reposit\u00f3rios, foi feita uma tentativa de identificar o participante que realmente fez as altera\u00e7\u00f5es. Apesar do registro de todos os commits estar ativado, n\u00e3o havia entradas nos logs para duas altera\u00e7\u00f5es maliciosas. Ficou claro que houve uma comprometimento da infraestrutura, pois os commits foram adicionados diretamente, contornando a conex\u00e3o atrav\u00e9s do gitolite. <\/p>\n
O servidor git.php.net foi rapidamente desligado, e o reposit\u00f3rio prim\u00e1rio foi transferido para o GitHub. Na pressa, passou-se por alto que, al\u00e9m do SSH usando gitolite, havia outra entrada que permitia enviar commits via HTTPS. Neste caso, para interagir com o Git, usou-se o backend git-http-backend, e a autentica\u00e7\u00e3o foi realizada atrav\u00e9s do servidor HTTP Apache2, que verificava as credenciais por meio de uma consulta ao banco de dados, hospedado em um SGBD em servidor<\/a> master.php.net. O acesso era permitido n\u00e3o apenas por chaves, mas tamb\u00e9m por uma senha comum. A an\u00e1lise dos logs do servidor http confirmou que altera\u00e7\u00f5es maliciosas foram adicionadas via HTTPS. <\/p>\n Ao examinar os logs, foi identificado que os atacantes n\u00e3o se conectaram na primeira tentativa, mas inicialmente tentaram adivinhar o nome da conta, e ap\u00f3s a identifica\u00e7\u00e3o, conseguiram entrar na primeira tentativa, ou seja, sabiam antecipadamente as senhas de Rasmus e Nikita, mas n\u00e3o conheciam seus logins. Se os atacantes conseguiram acessar o SGBD, n\u00e3o est\u00e1 claro por que n\u00e3o utilizaram imediatamente o login correto l\u00e1 especificado. Esta inconsist\u00eancia ainda n\u00e3o foi devidamente explicada. A invas\u00e3o do master.php.net \u00e9 considerada o cen\u00e1rio mais prov\u00e1vel, j\u00e1 que neste servidor<\/a> foram utilizados c\u00f3digos muito antigos e um sistema operacional desatualizado, que h\u00e1 muito n\u00e3o recebia atualiza\u00e7\u00f5es e continha vulnerabilidades n\u00e3o corrigidas. <\/p>\n Entre as a\u00e7\u00f5es tomadas, destaca-se a reinstala\u00e7\u00e3o do ambiente do servidor master.php.net e a migra\u00e7\u00e3o dos scripts para a nova vers\u00e3o PHP 8. O c\u00f3digo para trabalhar com o SGBD foi refeito para utilizar consultas parametrizadas, que dificultam a inje\u00e7\u00e3o de c\u00f3digo SQL. Para armazenar hashes de senhas no banco de dados, foi utilizado o algoritmo bcrypt (anteriormente, as senhas eram armazenadas usando o hash MD5 n\u00e3o confi\u00e1vel). As senhas existentes foram redefinidas e foi proposto que um novo password fosse estabelecido atrav\u00e9s do formul\u00e1rio de recupera\u00e7\u00e3o de senha. Como o acesso aos reposit\u00f3rios git.php.net e svn.php.net via HTTPS estava vinculado aos hashes MD5, decidiu-se manter git.php.net e svn.php.net em modo somente leitura, al\u00e9m de transferir todos os reposit\u00f3rios restantes de extens\u00f5es PECL para o GitHub, seguindo o mesmo padr\u00e3o do reposit\u00f3rio principal do PHP. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Relat\u00f3rio de comprometimento do reposit\u00f3rio git e da base de usu\u00e1rios do projeto PHP | ProHoster","description":"Os primeiros resultados da an\u00e1lise do incidente, relacionado \u00e0 identifica\u00e7\u00e3o de dois commits maliciosos com backdoor no reposit\u00f3rio Git do projeto PHP, que s\u00e3o ativados ao enviar uma solicita\u00e7\u00e3o com um cabe\u00e7alho especialmente formatado, foram publicados.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"