PHP Shakes the Web: Git Server Hacked
The Attack
PHP has also come under fire from web hackers, who were the victim of the attack on a GIT server. According to the information disclosed through the official PHP release , two malicious commits were sent as Nikita Popov and Rasmus Lerdorf, compromising git.php.net.
PHP immediately decided to stop the server and push any future changes to GitHub instead of git.php.net.
The two malicious commits were inserted into the source code as “fix typos”, i.e. passing them off as simple spelling corrections made by the developers.
In addition, the code also included the
zend_eval_string
instruction used by the attacker to install the backdoor that would then allow him to execute remote code execution (RCE) on any website that executed the tampered code.
Probably the recent attack on SolarWinds’ Orion alerted PHP which, from the beginning, intervened to limit the damage of the hacker attack. In fact, the recent attack on U.S. government agencies and the attack on PHP seem to have the same matrix. Even in the case of SolarWinds, the vulnerability of the platform had allowed the source code to be modified, allowing hackers to execute the code directly remotely.
How to ward off this type of attack
PHP’s first request to its users was to use GitHub for edits, or to join the organization if they weren’t.
The huge advantage of using platforms like GitHub or CodeCommit is that, almost always, the attack surface would boil down to simply stealing credentials from the victim’s PC. Whereas, in the case of PHP, a vulnerability in Git has been exploited, or a “too permissive” configuration of it.
Amazon Web Services offers the CodeCommit service that takes care of the security of your Git repository. Customers generally use private repositories that are not visible to the public even in read-only mode. CodeCommit integrates with AWS IAM to manage access across users, roles, groups, and access policies. Proper management of these elements allows you to keep access to the repository safe (always after theft of credentials and passwords). In addition, CodeCommit does not allow the use of public repositories such as GitHub or GitLab, or its own Git server.
So in the case of PHP it wouldn’t have been usable because it’s free software that needs to be visible to the community.
