Jan\u00eb publikuar rezultatet e para t\u00eb hetimit mbi incidentin e identifikimit t\u00eb dy komiteteve t\u00eb d\u00ebmshme me backdoor n\u00eb Git-repozitorin e projektit PHP, t\u00eb aktivizuara gjat\u00eb d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese me nj\u00eb titull t\u00eb ve\u00e7ant\u00eb User Agent. Gjat\u00eb studimit t\u00eb gjurm\u00ebve t\u00eb aktivitetit t\u00eb sulmuesve, u arrit n\u00eb p\u00ebrfundimin se serveri git.php.net, ku ishte vendosur git-repozitori, nuk ishte komprometuar, por ishte kompromentuar baza e t\u00eb dh\u00ebnave me llogarit\u00eb e zhvilluesve t\u00eb projektit. <\/p>\n
Nuk p\u00ebrjashtohet mund\u00ebsia q\u00eb sulmuesit t\u00eb ken\u00eb arritur t\u00eb ngarkojn\u00eb baz\u00ebn e p\u00ebrdoruesve, e cila ishte ruajtur n\u00eb DBMS n\u00eb serverin master.php.net. P\u00ebrmbajtja e master.php.net tashm\u00eb \u00ebsht\u00eb transferuar n\u00eb serverin e ri main.php.net, i instaluar nga fillimi. T\u00eb gjitha fjal\u00ebkalimet e zhvilluesve q\u00eb u p\u00ebrdor\u00ebn p\u00ebr qasje n\u00eb infrastruktur\u00ebn php.net jan\u00eb ricikluar dhe \u00ebsht\u00eb iniciuar procesi p\u00ebr ndryshimin e tyre n\u00ebp\u00ebrmjet nj\u00eb forme t\u00eb ve\u00e7ant\u00eb p\u00ebr rikuperimin e fjal\u00ebkalimit. Repozitorit\u00eb git.php.net dhe svn.php.net mbeten t\u00eb disponueshme n\u00eb m\u00ebnyr\u00eb vet\u00ebm p\u00ebr lexim (zhvillimi \u00ebsht\u00eb transferuar n\u00eb GitHub). <\/p>\n
Pas zbulimit t\u00eb komitetit t\u00eb par\u00eb t\u00eb d\u00ebmsh\u00ebm, i kryer nga llogaria e Rasmus Lerdorfit, themeluesit t\u00eb PHP, u b\u00eb nj\u00eb supozim se llogaria e tij ishte komprometuar dhe Nikita Popov, nj\u00eb nga zhvilluesit kryesor\u00eb t\u00eb PHP, e riktheu ndryshimin dhe bllokoi t\u00eb drejtat e komitetit p\u00ebr llogarin\u00eb e problematik\u00ebs. Pasi kaloi nj\u00eb koh\u00eb, erdhi kuptimi se bllokimi nuk kishte kuptim, sepse pa verifikimin e komiteteve p\u00ebrmes n\u00ebnshkrimit digjital, \u00e7do pjes\u00ebtar me qasje n\u00eb repo php-src mund t\u00eb b\u00ebnte nj\u00eb ndryshim, duke futur nj\u00eb em\u00ebr t\u00eb rrem\u00eb autori. <\/p>\n
M\u00eb pas, sulmuesit d\u00ebrguan nj\u00eb komitet t\u00eb d\u00ebmsh\u00ebm n\u00eb em\u00ebr t\u00eb vet\u00eb Nikit\u00ebs. N\u00ebp\u00ebrmjet analiz\u00ebs s\u00eb logeve t\u00eb sh\u00ebrbimit gitolite, i p\u00ebrdorur p\u00ebr organizimin e aksesit n\u00eb repozitor\u00eb, u b\u00eb nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb p\u00ebrcaktuar pjes\u00ebmarr\u00ebsin q\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb kishte realizuar ndryshimet. Pavar\u00ebsisht regjistrimit t\u00eb t\u00eb gjitha komiteteve, nuk kishte shenja n\u00eb log p\u00ebr dy ndryshimet e d\u00ebmshme. U b\u00eb e qart\u00eb se kishte nj\u00eb komprometim t\u00eb infrastruktur\u00ebs, pasi komitetet ishin shtuar drejtp\u00ebrdrejt, pa kalim p\u00ebrmes gitolite. <\/p>\n
Server git.php.net was promptly disabled, and the primary repository was moved to GitHub. In the rush, it was overlooked that there was another access point besides SSH using gitolite, which allowed commits to be sent via HTTPS. In this case, interaction with Git used the backend git-http-backend, and authentication was carried out using the Apache2 HTTP server, which verified credentials through a query to the database hosted in the DBMS on server<\/a> master.php.net. Access was allowed not only by keys but also by a regular password. The analysis of the server logs confirmed that malicious changes were introduced via HTTPS. <\/p>\n Upon examining the logs, it was found that the attackers did not connect on the first attempt; initially, they tried to guess the account name, but after discovering it, they accessed it on the first try, meaning they already knew the passwords of Rasmus and Nikita but did not know their usernames. If the attackers were able to access the DBMS, it is unclear why they did not immediately use the correct username listed there. This inconsistency has yet to receive a credible explanation. The hacking of master.php.net is considered the most likely scenario, as it was based on very old code and an outdated operating system that had not been updated for a long time and had unpatched vulnerabilities. server<\/a> Actions taken include reinstalling the environment of the master.php.net server and updating scripts to the new PHP 8 version. The code for interacting with the DBMS has been reworked to use parameterized queries, making SQL code substitution more difficult. To store password hashes in the DB, the bcrypt algorithm was employed (previously, passwords were stored using the unreliable MD5 hash). Existing passwords were reset, and users were prompted to set a new password via the password recovery form. Since access to the repositories git.php.net and svn.php.net via HTTPS was tied to MD5 hashes, it was decided to leave git.php.net and svn.php.net in read-only mode and also transfer all remaining PECL extension repositories to GitHub, following the example of the main PHP repository. <\/p>\n Nga veprimet e nd\u00ebrmarra, u sh\u00ebnua riinstalimi i ambientit t\u00eb serverit master.php.net dhe kalimi i skripteve n\u00eb versionin e ri PHP 8. Kodi p\u00ebr funksionimin me SGBD \u00ebsht\u00eb rishkruar p\u00ebr t\u00eb p\u00ebrdorur k\u00ebrkesa parametrike, t\u00eb cilat e komplikojn\u00eb z\u00ebvend\u00ebsimin e kodit SQL. P\u00ebr ruajtjen e hash-eve t\u00eb fjal\u00ebkalimeve n\u00eb DB, \u00ebsht\u00eb p\u00ebrdorur algoritmi bcrypt (m\u00eb par\u00eb, fjal\u00ebkalimet ruheshin duke p\u00ebrdorur hash-in e pasigurt MD5). Fjal\u00ebkalimet ekzistuese jan\u00eb rivendosur dhe \u00ebsht\u00eb propozuar t\u00eb vendoset nj\u00eb fjal\u00ebkalim i ri p\u00ebrmes formularit p\u00ebr rikuperimin e fjal\u00ebkalimit. Duke qen\u00eb se aksesin n\u00eb depot git.php.net dhe svn.php.net p\u00ebr HTTPS ishte i lidhur me hash-et MD5, \u00ebsht\u00eb vendosur t\u00eb mbeten git.php.net dhe svn.php.net n\u00eb modalitetin vet\u00ebm p\u00ebr lexim, dhe gjithashtu t\u00eb transferohen t\u00eb gjitha depot e mbetura t\u00eb zgjerimeve PECL n\u00eb GitHub, n\u00eb p\u00ebrputhje me depot kryesore t\u00eb PHP. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c User Agent. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 git.php.net, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043d\u0435 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043d\u043e \u0431\u044b\u043b\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Raporti mbi komprometimin e git-repozitorit dhe baz\u00ebs s\u00eb p\u00ebrdoruesve t\u00eb projektit PHP | ProHoster","description":"Jan\u00eb publikuar rezultatet e para t\u00eb analiz\u00ebs s\u00eb incidentit lidhur me identifikimin n\u00eb depo Git t\u00eb projektit PHP t\u00eb dy komiteteve t\u00eb d\u00ebmshme me backdoor, t\u00eb aktivizuar kur dor\u00ebzohet nj\u00eb k\u00ebrkes\u00eb me nj\u00eb titull t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u0447\u0451\u0442 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0431\u0430\u0437\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0432 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c, \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/otchyot-o-komprometaczii-git-repozitoriya-i-bazy-polzovatelej-proekta-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-07T08:22:44+00:00","article:modified_time":"2021-04-07T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99679","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-07 09:53:42","updated":"2026-02-09 21:39:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/99679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=99679"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/99679\/revisions"}],"predecessor-version":[{"id":159941,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/99679\/revisions\/159941"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=99679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=99679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=99679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"