{"id":99679,"date":"2021-04-07T10:22:44","date_gmt":"2021-04-07T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php"},"modified":"2021-04-07T10:22:44","modified_gmt":"2021-04-07T08:22:44","slug":"otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","title":{"rendered":"Poro\u010dilo o kompromitaciji git-repozitorija in baze uporabnikov projekta PHP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Objavljeni so prvi rezultati preiskave incidenta, povezanega z odkritjem dveh zlonamernih commitov z backdoorom v git-repozitoriju projekta PHP, ki se aktivirata ob po\u0161iljanju zahteve s posebno oblikovanim naslovom User Agent. Med prou\u010devanjem sledi delovanja napadalcev je bilo ugotovljeno, da neposredno stre\u017enik git.php.net, na katerem je bil gostovan git-repozitorij, ni bil vdreti, vendar je bila kompromitirana baza podatkov z ra\u010dunom razvijalcev projekta. <\/p>\n

Ne izklju\u010duje se mo\u017enost, da so napadalci uspeli prenesti bazo uporabnikov, shranjeno v SDB na stre\u017eniku master.php.net. Vsebina master.php.net je \u017ee bila premaknjena na nov stre\u017enik main.php.net, ki je bil nastavljen na novo. Vse gesla razvijalcev, ki so bila uporabljena za dostop do infrastrukture php.net, so bila ponastavljena in za\u010del se je postopek njihove zamenjave preko posebnega obrazca za obnovitev gesla. Repozitoriji git.php.net in svn.php.net ostajajo dostopni v na\u010dinu samo za branje (razvoj je bil prenesen na GitHub). <\/p>\n

Po odkritju prvega zlonamernega commita, izvedenega preko ra\u010duna Rasmusa Lerdorfa, ustanovitelja PHP, je bilo domnevano, da je bil njegov ra\u010dun vdreti, in Nikita Popov, eden klju\u010dnih razvijalcev PHP, je vrnil spremembe in blokiral pravice commit za problemati\u010dni ra\u010dun. Kmalu po tem je pri\u0161lo do spoznanja, da blokada ni imela smisla, saj brez overitve commitov s pomo\u010djo digitalnega podpisa lahko vsak udele\u017eenec z dostopom do repozitorija php-src uvede spremembo, tako da vnese la\u017eno ime avtorja. <\/p>\n

Nato so napadalci poslali zlonamerni commit v imenu samega Nikite. S pomo\u010djo analize dnevnikov storitve gitolite, uporabljene za organizacijo dostopa do repozitorijev, je bilo podjetni\u0161tvo za ugotovitev udele\u017eenca, ki je resni\u010dno izvedel spremembe. Kljub vklopljenemu bele\u017eenju vseh commitov v dnevniku ni bilo zapisov za dve zlonamerni spremembi. Postalo je jasno, da gre za kompromitacijo infrastrukture, saj so bili commit-i dodani neposredno, obidejo povezavo prek gitolite. <\/p>\n

Stre\u0161no je ukinjen server git.php.net, a primarni repozitorij je preba\u010den na GitHub. U \u017eurbi se zaboravilo da za pristup repozitoriju osim SSH putem gitolita postoji jo\u0161 jedan ulaz koji omogu\u0107ava slanje commit-a putem HTTPS-a. U ovom slu\u010daju se za interakciju s Git-om koristio backend git-http-backend, a autentifikacija se vr\u0161ila putem HTTP servera Apache2, koji je proveravao ovla\u0161\u0107enja pozivaju\u0107i se na bazu podataka smje\u0161tenu u SDB-a na stre\u017enikom<\/a> master.php.net. Pristup je bio mogu\u0107 ne samo putem klju\u010deva, ve\u0107 i obi\u010dne lozinke. Analiza logova http servera je potvrdila da su zlonamjerne izmene dodate preko HTTPS-a. <\/p>\n

Istra\u017eivanjem logova je utvr\u0111eno da su napada\u010di pristupili ne iz prvog poku\u0161aja, ve\u0107 su najpre poku\u0161avali da pogode naziv korisni\u010dkog ra\u010duna, ali su nakon utvr\u0111ivanja uspeli iz prvog poku\u0161aja, tj. unapred su znali lozinke Rasmusa i Nikite, ali nisu znali njihove korisni\u010dke naloge. Ako su napada\u010di mogli da dobiju pristup SDB-u, nejasno je za\u0161to odmah nisu upotrebili ispravan korisni\u010dki ra\u010dun koji je tamo naveden. Ova nesukladnost jo\u0161 uvek nema verodostojno obja\u0161njenje. Hakerski napad na master.php.net se smatra najverovatnijim scenarijom, po\u0161to je na tom stre\u017enikom<\/a> koriste\u0107i vrlo stari kod i zastarelu operativnu sistem, koji se ve\u0107 dugo nije a\u017eurirao i imao je neispravljene ranjivosti. <\/p>\n

Od preduzetih akcija isti\u010de se reinstalacija okru\u017eenja servera master.php.net i prebacivanje skripti na novu verziju PHP 8. Kod za rad sa SDB-om je prepravljen kako bi koristio parametarske upite, \u0161to ote\u017eava umetanje SQL koda. Za \u010duvanje he\u0161eva lozinki u bazi podataka kori\u0161\u0107en je algoritam bcrypt (ranije su se lozinke \u010duvale koriste\u0107i nepouzdan MD5 he\u0161). Postoje\u0107e lozinke su resetovane i predlo\u017eeno je da se postavi nova lozinka putem forme za oporavak lozinke. Po\u0161to je pristup repozitorijima git.php.net i svn.php.net putem HTTPS bio povezan sa MD5 he\u0161evima, odlu\u010deno je da se git.php.net i svn.php.net ostave u re\u017eimu samo za \u010ditanje, kao i da se svi preostali repozitoriji ekstenzija PECL prebacuju na GitHub, sli\u010dno kao osnovni repozitorij PHP-a.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Poro\u010dilo o kompromitaciji git repozitorija in baze uporabnikov projekta PHP | ProHoster","description":"Objavljeni so prvi rezultati preiskave incidenta, povezanega z odkrivanjem dveh zlonamernih commitov z backdoorjem v Git repozitoriju projekta PHP, ki se aktivira ob posredovanju zahtevka s posebej oblikovano glavo.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}