Jan\u00eb publikuar rezultatet e para t\u00eb hetimit t\u00eb incidentit q\u00eb lidhet me identifikimin n\u00eb Git-repozitorin e projektit PHP t\u00eb dy komiteteve t\u00eb d\u00ebmshme me backdoor, t\u00eb aktivizuara gjat\u00eb d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese me nj\u00eb titull t\u00eb ve\u00e7ant\u00eb User Agent. Gjat\u00eb studimit t\u00eb gjurm\u00ebve t\u00eb veprimit t\u00eb sulmuesve, u arrit n\u00eb p\u00ebrfundimin se serveri git.php.net, n\u00eb t\u00eb cilin ishte vendosur git-repozitori, nuk ishte komprometuar, por ishte kompromentuar databaza me llogarit\u00eb e zhvilluesve t\u00eb projektit. <\/p>\n
Nuk p\u00ebrjashtohet mund\u00ebsia q\u00eb sulmuesit t\u00eb ken\u00eb arritur t\u00eb ngarkojn\u00eb baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve, e cila ruhej n\u00eb DB n\u00eb serverin master.php.net. P\u00ebrmbajtja e master.php.net tashm\u00eb \u00ebsht\u00eb transferuar n\u00eb serverin e ri main.php.net, i vendosur nga e para. T\u00eb gjitha fjal\u00ebkalimet e zhvilluesve, t\u00eb p\u00ebrdorura p\u00ebr qasje n\u00eb infrastruktur\u00ebn php.net, jan\u00eb resetuar dhe \u00ebsht\u00eb iniciuar procesi i nd\u00ebrrimit t\u00eb tyre p\u00ebrmes nj\u00eb forme t\u00eb ve\u00e7ant\u00eb p\u00ebr rikuperimin e fjal\u00ebkalimit. Repozitorit\u00eb git.php.net dhe svn.php.net mbeten t\u00eb disponueshme n\u00eb m\u00ebnyr\u00eb vet\u00ebm p\u00ebr lexim (zhvillimi \u00ebsht\u00eb kaluar n\u00eb GitHub). <\/p>\n
Pas zbulimit t\u00eb komedit t\u00eb par\u00eb t\u00eb d\u00ebmsh\u00ebm, t\u00eb kryer nga llogaria e Rasmus Lerdorf, themeluesit t\u00eb PHP, u supozua se llogaria e tij ishte komprometuar dhe Nikita Popov, nj\u00eb nga zhvilluesit kryesor\u00eb t\u00eb PHP, rrokulli i b\u00ebri ndryshimet dhe bllokoi t\u00eb drejtat e komedive p\u00ebr llogarin\u00eb problematike. Pas nj\u00eb kohe, erdhi nj\u00eb kuptim se bllokimi nuk kishte kuptim, pasi pa verifikimin e komedive p\u00ebrmes n\u00ebnshkrimit digjital, \u00e7do pjes\u00ebmarr\u00ebs me qasje n\u00eb repozitorin php-src mund t\u00eb b\u00ebnte nj\u00eb ndryshim, duke futur nj\u00eb em\u00ebr t\u00eb rrem\u00eb autori. <\/p>\n
M\u00eb pas, sulmuesit d\u00ebrguan nj\u00eb komed t\u00eb d\u00ebmsh\u00ebm n\u00eb em\u00ebr t\u00eb vet\u00eb Nikit\u00ebs. P\u00ebrmes analiz\u00ebs s\u00eb logeve t\u00eb sh\u00ebrbimit gitolite, i cili p\u00ebrdoret p\u00ebr t\u00eb organizuar aksesin n\u00eb repozitor\u00eb, u b\u00eb nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb p\u00ebrcaktuar pjes\u00ebmarr\u00ebsin q\u00eb v\u00ebrtet b\u00ebri ndryshimet. Pavar\u00ebsisht se ishte p\u00ebrfshir\u00eb regjistrimi i t\u00eb gjitha komedive, p\u00ebr dy ndryshime t\u00eb d\u00ebmshme nuk kishte regjistrime n\u00eb log. U b\u00eb e qart\u00eb se kishte nj\u00eb kompromitim t\u00eb infrastruktur\u00ebs, pasi komedit ishin shtuar drejtp\u00ebrdrejt, duke shmangur lidhjen p\u00ebrmes gitolite. <\/p>\n
Serveri git.php.net \u00ebsht\u00eb \u00e7aktivizuar menj\u00ebher\u00eb dhe depozita kryesore \u00ebsht\u00eb transferuar n\u00eb GitHub. N\u00eb nxitim u harua se p\u00ebr t\u00eb aksesuar depozit\u00ebn, p\u00ebrve\u00e7 SSH me p\u00ebrdorimin e gitolite, kishte nj\u00eb hyrje tjet\u00ebr q\u00eb lejonte d\u00ebrgimin e komiteteve p\u00ebrmes HTTPS. N\u00eb k\u00ebt\u00eb rast, p\u00ebr nd\u00ebrveprimin me Git u p\u00ebrdor backend-i git-http-backend, dhe autentifikimi u krye p\u00ebrmes serverit HTTP Apache2, i cili kontrollonte kredencialet duke iu drejtuar nj\u00eb baze t\u00eb dh\u00ebnash e vendosur n\u00eb DBMS n\u00eb serveri<\/a> master.php.net. Lejohej hyrja jo vet\u00ebm p\u00ebrmes \u00e7el\u00ebsave, por edhe me nj\u00eb fjal\u00ebkalim t\u00eb zakonsh\u00ebm. Analiza e log\u00ebve t\u00eb serverit http konfirmoi se ndryshimet e keqdashura ishin shtuar p\u00ebrmes HTTPS. <\/p>\n Gjat\u00eb analizimit t\u00eb logeve, u zbulua se sulmuesit nuk u lidh\u00ebn n\u00eb tentativ\u00ebn e par\u00eb, por fillimisht p\u00ebrpiqeshin t\u00eb gjenin emrin e llogaris\u00eb, dhe pas identifikimit hyn\u00eb n\u00eb sistem me tentativ\u00ebn e par\u00eb, dmth. ata e dinin paraprakisht fjal\u00ebkalimin e Rasmu dhe Nikita, por nuk e dinin emrin e tyre t\u00eb p\u00ebrdoruesit. N\u00ebse sulmuesit arrit\u00ebn t\u00eb aksesojn\u00eb DBMS, nuk \u00ebsht\u00eb e qart\u00eb pse ata nuk e p\u00ebrdor\u00ebn menj\u00ebher\u00eb emrin e sakt\u00eb t\u00eb p\u00ebrdoruesit t\u00eb treguar aty. Kjo pasakt\u00ebsi ende nuk ka marr\u00eb nj\u00eb shpjegim t\u00eb besuesh\u00ebm. Hacking-i i master.php.net shihet si skenari m\u00eb i mundsh\u00ebm, pasi n\u00eb k\u00ebt\u00eb serveri<\/a> u p\u00ebrdor nj\u00eb kod shum\u00eb i vjet\u00ebr dhe nj\u00eb OS e kaluar, t\u00eb cilat nuk jan\u00eb azhurnuar prej koh\u00ebsh dhe kan\u00eb dob\u00ebsi t\u00eb pa riparuara. <\/p>\n Veprimet e nd\u00ebrmarra p\u00ebrfshijn\u00eb rivendosjen e mjedisit t\u00eb serverit master.php.net dhe kalimin e skripteve n\u00eb versionin e ri PHP 8. Kodi p\u00ebr pun\u00ebn me SGBD \u00ebsht\u00eb riparuar p\u00ebr t\u00eb p\u00ebrdorur k\u00ebrkesa parametrizuese, t\u00eb cilat e v\u00ebshtir\u00ebsojn\u00eb infrastruktur\u00ebn e kodit SQL. P\u00ebr ruajtjen e hash-eve t\u00eb fjal\u00ebkalimeve n\u00eb DB \u00ebsht\u00eb p\u00ebrdorur algoritmi bcrypt (m\u00eb par\u00eb fjal\u00ebkalimet u ruajt\u00ebn duke p\u00ebrdorur hash-in e pasigurt MD5). Fjal\u00ebkalimet ekzistuese jan\u00eb riaktivizuar dhe u \u00ebsht\u00eb k\u00ebrkuar p\u00ebrdoruesve q\u00eb t\u00eb vendosin nj\u00eb fjal\u00ebkalim t\u00eb ri p\u00ebrmes formularit t\u00eb rikuperimit t\u00eb fjal\u00ebkalimit. Duke qen\u00eb se aksesit n\u00eb depot git.php.net dhe svn.php.net p\u00ebrmes HTTPS iu dha nj\u00eb lidhje me hash-et MD5, \u00ebsht\u00eb vendosur q\u00eb git.php.net dhe svn.php.net t\u00eb mbeten n\u00eb modin vet\u00ebm p\u00ebr lexim, si dhe t\u00eb transferohet t\u00eb gjitha depot e mbetura t\u00eb zgjerimeve PECL n\u00eb GitHub, n\u00eb p\u00ebrputhje me depot kryesore t\u00eb PHP. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Raporti mbi kompromentimin e git-repozitorit dhe baz\u00ebs s\u00eb p\u00ebrdoruesve t\u00eb projektit PHP | ProHoster","description":"Jan\u00eb publikuar rezultatet e para t\u00eb analiz\u00ebs s\u00eb incidentit, i lidhur me identifikimin n\u00eb git-repozitorin e projektit PHP t\u00eb dy komiteteve t\u00eb d\u00ebmshme me backdoor, t\u00eb aktivizuar nga d\u00ebrgimi i k\u00ebrkes\u00ebs me nj\u00eb titull t\u00eb ve\u00e7ant\u00eb User Agent. Gjat\u00eb hetimit t\u00eb gjurm\u00ebve t\u00eb veprimtaris\u00eb s\u00eb sulmuesve, u arrit n\u00eb p\u00ebrfundimin se serveri git.php.net, ku ishte vendosur git-repozitori, nuk ishte hakuar, por ishte kompromentuar baza e t\u00eb dh\u00ebnave me llogarit\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"