PHP’s Git Server hacked - Two Remote Code executions added to the source code, let us discuss

Key Takeaways

what's going on guys my name is hussein and the php source code have been infiltrated and two nasty commits have been committed to the code base just like that and the scary thing is nobody knows how so let's get into the article and discuss this this is uh this is the first time i've seen something like that so bleeping computer reporting reported this and thank you for uh you guys sent me a lot of you sent me this article to report on this so php get server hacked to add backdoors to php source code so if you don't know guys php is a very very popular server server-side language i've been trinketing with this language since the 2000s early 2000s and the last time i wrote php code was i don't know 2003 maybe and i stopped stopped using it because basically i moved stack to dot net and then now javascript and yeah it's just uh but yeah i love php is a great language i don't know if you used it but i absolutely love it and it's usually it's combined with other stack right nice little lamp stack and or the wamp stack so php source code is written in c and it's hosted on a git server a custom good server that is backed by uh by the maintainers of the php and then all of a sudden people started noticing this so the maintainers came in and said they saw er look at this commit guys this is funny fix typo yeah look at this and the erasmus lured off is is one of the maintenances signed off by so it looks legit right so it's committed and looks good so look at that it's uh and it says hey fix table so if you look at it from there i was like oh this this guy just fixed the title but but look at the typo they fixed oh my god all right look at that i'm gonna start i'm gonna try to zoom in way down here this is it this code says okay it uses the http port server and it looks through the header that's called http user agent tt with an extra t right and what it does it if the string in the http server agent contains zero diem whatever that thing is then go ahead and evaluate that string immediately execute that string so essentially you can once you if you download php and install it and run it right with that configuration i as a shady person can send you a maliciously crafted http request with this particular http user agent and then put in a nasty php code and it would be excluded in the backend and i think you can technically maybe execute c code i don't know how this works to be honest like i don't know much of c language but this is nasty a remote code execution essentially and they explain it right here so as a result and you might say hussein how did they sign off as someone else apparently you can't do that i did not know that here's a here is here here's how you do it spoof a comment on github from anyone you can essentially do that why why would anyone want why is this a feature why is this a feature i don't understand this should be blocked right so as a result of this incident the maintainers of the php uh code base decides you know what this is not worth it apparently this is not the first incident they said they want to move to github as their main main repository and we've seen a lot of open source code move to github because github yeah it's maintained by microsoft and some people have their criticism about that but if you look from long term yeah hi so if you look long term actually it's actually a good idea because now github is instead of spinning up your own git server and and worry about patches and what about security flaws you just let github do this work for you and you can and and there's two-factor authentication so you know everyone that is signing in github it's trusted so not hacks like this cannot happen on github so you read this is dangerous stuff and uh when asked they asked the maintainers did anyone build the code base when those two commits existed in the code base and they said nobody actually managed to do that because they discovered two hours ago and then they immediately reverted and even so this has been done in the development branch which is bhp 8.1 so it's not and people usually when they install they install the release version nobody i'm not aware of anyone installing a development version of php most people don't right unless you're really hardcore you're like the facebook of the world where you are essentially pushing uh features to the php language because the whole thing is built in php facebook right so they build php so they will be on the development branch i would assume to test and test the features of of the php language guys this is nasty stuff and i'm glad that they moved to github i i don't know what do you guys think about this because i know curl is has moved has moved to github because it's just easier for the open source maintaining and this this is one thing one less thing to worry about right and i know i understand totally understand that some people have their reservation about uh github being on by one monolith which is microsoft and it's always a better idea to have your own but look at that those people cannot afford hosting their own server yeah but even worrying about all this security stuff they have a job the job is to write code their job is not to maintain servers and and patch and security that's just a lot of work that's devops that is just that's just you you need your own team to maintain all of this stuff so i kind of i kind of agree with their move i'm glad they did all that stuff here's one statement that they mentioned here um bleeping computer reached out a court bleeping computer reached out to both popov and the php security team to find out the complete extent of this compromise and if any code was distributed downstream before the malicious commits were the caught it may cut it may have cloned forked in the meantime but the changes did not make it into any tags or release artifacts so it was not built as a beta or an alpha right or anything that that will be downloaded by an end developer right the changes were uh on the development branch of php811 which is due to release at the end of the year pop off uh further told bleeping computer guys what do you think about this uh this this is one of the first time i i've seen anyone just just straight up commit nasty remote code execution into the source code yeah i see i guess we live and see stuff all right guys i'm gonna see in the next one you guys stay awesome go buy your