{"id":99679,"date":"2021-04-07T10:22:44","date_gmt":"2021-04-07T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php"},"modified":"2021-04-07T10:22:44","modified_gmt":"2021-04-07T08:22:44","slug":"otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","title":{"rendered":"Raport despre compromiterea repository-ului git \u0219i a bazei de utilizatori a proiectului PHP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Au fost publicate primele rezultate ale analizei incidentului legat de descoperirea \u00een Git-repository-ul proiectului PHP a dou\u0103 commituri mali\u021bioase cu un backdoor, activat la trimiterea unei solicit\u0103ri cu un headere User Agent special format. \u00cen urma studiului urm\u0103rilor activit\u0103\u021bii atacatorilor, s-a ajuns la concluzia c\u0103 serverul git.php.net, pe care a fost g\u0103zduit repository-ul git, nu a fost compromis, dar baza de date cu conturile dezvoltatorilor proiectului a fost afectat\u0103. <\/p>\n

Nu se exclude posibilitatea ca atacatorii s\u0103 fi putut desc\u0103rca baza de utilizatori, stocat\u0103 \u00een SGBD-ul de pe serverul master.php.net. Con\u021binutul master.php.net a fost deja mutat pe un nou server main.php.net, instalat de la zero. Toate parolele dezvoltatorilor folosite pentru accesarea infrastructurii php.net au fost resetate, iar procesul de schimbare a acestora a fost ini\u021biat printr-un formular special de recuperare a parolei. Repository-urile git.php.net \u0219i svn.php.net r\u0103m\u00e2n accesibile \u00een modul doar citire (dezvoltarea a fost mutat\u0103 pe GitHub). <\/p>\n

Dup\u0103 descoperirea primului commit mali\u021bios, realizat prin contul lui Rasmus Lerdorf, fondatorul PHP, s-a emis ipoteza c\u0103 contul s\u0103u a fost compromis \u0219i Nikita Popov, unul dintre dezvoltatorii cheie ai PHP, a revenit asupra modific\u0103rilor \u0219i a blocat drepturile de commit pentru contul problematic. Dup\u0103 un timp, s-a realizat c\u0103 blocarea nu avea sens, deoarece f\u0103r\u0103 verificarea commit-urilor prin semn\u0103tura digital\u0103, orice participant cu acces la repository-ul php-src putea aduce modific\u0103ri, substituind un nume fals de autor. <\/p>\n

Ulterior, atacatorii au trimis un commit mali\u021bios din partea lui Nikita. Prin analiza jurnalele serviciului gitolite, utilizat pentru organizarea accesului la repository-uri, a fost \u00eentreprins\u0103 o \u00eencercare de a determina participantul care a adus cu adev\u0103rat modific\u0103rile. Cu toate c\u0103 s-au \u00eenregistrat toate commit-urile, pentru cele dou\u0103 modific\u0103ri mali\u021bioase nu au existat \u00eenregistr\u0103ri \u00een log. A devenit clar c\u0103 are loc o compromitere a infrastructurii, deoarece commit-urile au fost ad\u0103ugate direct, ocolind conectarea prin gitolite. <\/p>\n

Serverul git.php.net a fost dezactivat rapid, iar repository-ul principal a fost mutat pe GitHub. \u00cen grab\u0103, s-a trecut cu vederea faptul c\u0103, pe l\u00e2ng\u0103 SSH folosind gitolite, exista \u0219i o alt\u0103 modalitate de acces pentru a face commit-uri prin HTTPS. \u00cen acest caz, pentru interac\u021biunea cu Git a fost utilizat backend-ul git-http-backend, iar autentificarea a fost efectuat\u0103 prin serverul HTTP Apache2, care verifica acreditivele prin intermediul unei baze de date stocate \u00een SGBD pe server<\/a> master.php.net. Se permitea accesul nu doar prin chei, ci \u0219i printr-o parol\u0103 obi\u0219nuit\u0103. Analiza jurnalelor serverului http a confirmat c\u0103 modific\u0103rile d\u0103un\u0103toare au fost ad\u0103ugate prin HTTPS. <\/p>\n

\u00cen examinarea jurnalelor s-a constatat c\u0103 atacatorii nu s-au conectat din prima \u00eencercare, ci mai \u00eent\u00e2i au \u00eencercat s\u0103 ghiceasc\u0103 numele contului, dar dup\u0103 ce au identificat, au intrat din prima \u00eencercare, adic\u0103 \u0219tiau dinainte parolele lui Rasmus \u0219i Nikita, dar nu cuno\u0219teau login-urile lor. Dac\u0103 atacatorii au reu\u0219it s\u0103 acceseze SGBD-ul, nu este clar de ce nu au folosit imediat loginul corect indicat acolo. Aceast\u0103 discrepan\u021b\u0103 nu a fost \u00eenc\u0103 explicat\u0103 credibil. Hack-ul master.php.net este considerat cel mai probabil scenariu, deoarece pe acest server<\/a> a fost folosit un cod foarte vechi \u0219i un sistem de operare \u00eenvechit, care nu au fost actualizate de mult timp \u0219i aveau vulnerabilit\u0103\u021bi necorectate. <\/p>\n

Dintre ac\u021biunile \u00eentreprinse se num\u0103r\u0103 reinstalarea mediului serverului master.php.net \u0219i migrarea scripturilor la noua versiune PHP 8. Codul pentru lucrul cu SGBD-ul a fost ref\u0103cut pentru a utiliza interog\u0103ri parametrizate, complic\u00e2nd substitu\u021bia codului SQL. Algoritmul bcrypt a fost folosit pentru stocarea hash-urilor parolelor \u00een baz\u0103 de date (\u00een trecut, parolele erau stocate folosind hashingul nesigur MD5). Parolele existente au fost resetate \u0219i s-a propus s\u0103 se stabileasc\u0103 o nou\u0103 parol\u0103 prin intermediul formularului de recuperare a parolei. Deoarece accesul la repository-urile git.php.net \u0219i svn.php.net prin HTTPS era legat de hash-urile MD5, s-a decis l\u0103sarea git.php.net \u0219i svn.php.net \u00een modul doar citire, precum \u0219i mutarea tuturor repository-urilor r\u0103mase de extensii PECL pe GitHub, similar cu repository-ul principal PHP.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Raport privind compromiterea repository-ului git \u0219i a bazei de utilizatori a proiectului PHP | ProHoster","description":"Au fost publicate primele rezultate ale analiz\u0103rii incidentului legat de descoperirea a dou\u0103 commit-uri d\u0103un\u0103toare cu backdoor \u00een repository-ul Git al proiectului PHP, activate prin trimiterea unei cereri cu un antet special formatat.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}