Malicious PhpMyAdmin Served From SourceForge Mirror 86
An anonymous reader writes with a bit of news about the compromised download of phpMyAdmin discovered on an sf.net mirror yesterday: "A malicious version of the open source Web-based MySQL database administration tool phpMyAdmin has been discovered on one of the official mirror sites of SourceForge, the popular online code repository for free and open source software. The file — phpMyAdmin-3.5.2.2-all-languages.zip — was modified to include a backdoor that allowed attackers to remotely execute PHP code on the server running the malicious version of phpMyAdmin."
The Sourceforge weblog has details. Someone compromised a mirror (since removed from rotation of course) around September 22nd. Luckily, only around 400 people grabbed the file before someone caught it.
True open sores experience (Score:1, Insightful)
Re:True open sores experience (Score:5, Informative)
How would you know which md5 hash was correct? They are listed in http://www.phpmyadmin.net/home_page/downloads.php [phpmyadmin.net] which is also hosted by sourceforge.
Re: (Score:3)
The mirrors are third-party and not under direct control of SF. I know, when I was working a datacenter one of our customers ran a mirror for them.
Re:True open sores experience (Score:5, Informative)
If sourceforge is totally compromised you are right but still the chances of that happening are almost certainly lower than the chances of a random download mirror being compromised, so checking md5s is still a good idea.
Re:True open sores experience (Score:5, Informative)
How would you know which md5 hash was correct?
We could reinvent the wheel, but (as usual) the Debian wizards figured it all out years ago, in this case, they solved the problem in 2003.
You make a big list of valid hashes, GPG sign the list with a well known key that is changed every couple years or so (for a good time see Debian package named debian-keyring), and publish it.
For a good time on a Debian box go to /var/lib/apt/lists and look at a packages file. Assuming you're using wheezy/amd64 the system won't let you install the latest 0ad package (wtf that package is) version 0r11863-2 unless the md5 hash of that package is some big ole number ending in 79eb. Also sha1 and sha256 hashes.
For a good time see
http://wiki.debian.org/SecureApt [debian.org]
I can hand you a questionable looking flash drive with debian packages on it and if the multiple signed hashes match Debian's official gpg signed hash list you can trust my binaries... I can't inject something extra without Fing up at least one of the three hashs.
Or, just go ahead and reinvent the wheel... thats a Security Best Practices that never leads to problems, rock on with your NIH self man!
Re: (Score:2)
I'm well aware that technology but I don't see how it is relevant here. I doubt you can convince the phpmyadmin developers to require the use of apt for downloading new releases of their software.
Re: (Score:2)
You're not that aware of the technology or it would be obvious to you what he meant by: "You make a big list of valid hashes, GPG sign the list..."
You do it this way:
http://www.djangoproject.com/m/pgp/Django-1.2.7.checksum.txt [djangoproject.com]
The stuff between: -----BEGIN PGP SIGNED MESSAGE-----
and:-----BEGIN PGP SIGNATURE-----
are signed by the corresponding signature.
more examples: http://distfiles.gentoo.org/releases/amd64/current-iso/stage3-amd64-20120621.tar.bz2.DIGESTS.asc [gentoo.org]
Re: (Score:1)
You don't have to use APT just to sign a simple text file list of hashes.
Re: (Score:2)
Well, you either use the signed (secure) distribution method and guarantee that you got what you asked for, or you don't. If they don't want to distribute it in such a way that their signature can be verified, that's their business - but that means this kind of thing can happen.
Not that it would likely matter. Their lack of support for signed code means they probably would leak their private key, thus negating any gains it would otherwise bring (and then some, as you have misplaced trust rather than no trus
Re: (Score:2)
I got it, I got it, I got it!
I got your number on the wall!
I got it, I got it, I got it!
For a good time, for a good time call....
Jenny, don't change your number.
I need to make you mine.
Jenny. I'll call your number,
812a11b49b1a1cce5dd9a0018899501e
812a11b49b1a1cce5dd9a0018899501e
Maybe not as catchy as 867-5309?
Get file and MD5 from separate sources (Score:2)
How would you know which md5 hash was correct?
OK, maybe I'm paranoid, but I usually get the download file and the MD5 from separate sources. Ideally the MD5 is from the home site of the project rather than one of its mirrors.
Re: (Score:1)
Re: (Score:1)
And had this been a Microsoft experience, millions of people would probably have downloaded it and never been informed when it was patched six months later - if it had been caught at all. I mean where did you think all those botnets are coming from?
Re: (Score:2)
They were downloading PhpMyAdmin, they're not the most tech savy of users...
Re: (Score:2, Funny)
I don't have any frenids either.
What's a frenid again?
Re: (Score:2)
Re: (Score:2, Informative)
No, but if any of them md5'd it they would have caught it. And in way less time than doing a code review!
Re: (Score:2)
And how many people actually do that? Presumably one of the 400 who downloaded it did, figured out who to alert and that's why we know.
But that's a very very small percentage.
This is likely a UI problem, doing an MD5 is easy enough, it's a matter of browsers showing them automatically and keeping the 'official' md5 page around while the download is finishing. None of this is hard, but the vast majority of users don't.
Re: (Score:2)
On Linux you generally have to open a terminal to very a hash
Generally I use one of the terminal windows I already have open.
Re: (Score:2)
No, but if any of them md5'd it they would have caught it.
Assuming they didn't get the MD5 from the same site.
Re: (Score:1)
Your point being? The problem was found within days. Compare that to what things would have looked like, had it been closed source. It's highly unlikely the backdoor would've been detected any sooner then.
Re: (Score:2)
"weblog"? (Score:5, Funny)
Is this 1998? Was the malicious file found on the world wide web?
Re:"weblog"? (Score:4, Insightful)
Re: (Score:3)
I know just how you feel, I make calls with my cellular telephone all the time. Words should never be abbreviated at all.
Re: (Score:2)
Sourceforge problems.. (Score:3, Informative)
I think someone's head is in the clouds at the moment what with the recent buyout of sourceforge, slashdot et al [engadget.com]. I'm with a big ol' (12 year) open source project on Sourceforge and it's going through the migration procedure currently to the new Sourceforge look and feel - lots of problems, lots of broken stuff, unhappy admins and developers and slow response to tickets.
There are plenty of alternatives out here now for the open source types to host their code. It might be time to start thinking about exit strategies..
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Duh. (Score:5, Insightful)
Anyone who understands how security works would consider phpMyAdmin's very existence on a server to be a security hole.
Local GUI client + ssh tunnel ftw.
Re:Duh. (Score:5, Informative)
My experience, exactly. I can't tell you how many times I've been asked to look into a problem with a web server only to find that their logs are packed with failed login attempts pointed at /phpmyadmin. It's bad enough that it blindly installs itself as a subdirectory in every Apache vhost you run; but their lack of default password attempt limits and bans (especially given its popularity and the level of access it provides) is downright irresponsible.
There are literally botnets that do nothing more than cruise around the internet looking for phpmyadmin installations.
Re: (Score:1)
Please propose a way to block hacking attempts coming from the same person, spread over multiple IPs which are not in the same range and are on a stateless protocol.
No you may not add rules to the firewall since you tool (phpmyadmin) has to handle that.
Re: (Score:2)
Why would any web admin tool have open access from any public IP in the first place? I know that the way I handle things for what I host here I limit access to certain narrow IP subnets that cover where the regular admin users would be coming from. Then if someone cannot access the tool because they are temporarily coming in from a different IP range then I can add that on the fly. You figure that, combined with some mechanism for temporarily disabling login access after a set number of failed attempts in a
Re: (Score:1)
Require login credentials input twice. Spit out a failure on the first attempt.
Re:Duh. (Score:5, Funny)
There, I fixed it for you. You're welcome.
Re: (Score:1)
Re: (Score:2)
We prefer you direct your noise hole elsewhere.
Oh dear. Just relax and let the butthurt flow through you [photobucket.com].
Re:Duh. well (Score:2)
There, I fixed it for you. You're welcome.
Not so much PHP (although every function is broken in some way), but the fact that any n00b can pick it up and start "programming." Without a harsh feedback loop, poor coding practices become calcified and lead to the massive security holes you've observed.
The beauty and curse of PHP is that its default fail state is to act as if nothing bad happened. This keeps unskilled, sloppy n00bs from getting so discouraged with the "NO YOU CAN'T FARKING ASSUME null AND false ARE THE SAME THING, DUMMY!" error messag
Re: (Score:2)
Re: (Score:2)
I do something a bit different. I tend to put any admin tools up in an /admin directory (ex, https://example.com/admin/phpmyadmin [example.com]), then use HTTP basic authentication to require users to authenticate with a username/password in our LDAP directory (but you could use local shell accounts as well). That way someone would need to first compromise a user account before they could even *start* trying to compromise one of the admin tools. I tend to think of it as a similar idea to not allowing remote root logins i
hate phpMyAdmin (Score:1)
I used to work in a Managed Hosting department, and customers would insist on having this piece of crap on the server. I hated it because there was always some vuln version that they ABSOLUTELY had to have. Finally a new exploit came out for a current version(at the time), and we had two compromises... Then we banned it across the entire customer base. There are too many alternatives to use this piece of garbage. However I suggest insisting your users run something on their local client side and not on your
Re: (Score:1)
insisting your users run something on their local client side and not on your server
Doesn't this involve allowing MySQL to accept connections from places other than localhost?
I think I'll stick to PuTTY + Postgres command line.
Re: (Score:1)
Not if you set up PuTTY to tunnel the remote machine's mysql port to a local port and using a GUI (or command line, if you like)
Which is the scary part? (Score:5, Insightful)
Scary.
One of the regional mirrors of the largested software respository containing tens of thousands of projects is either hacked or was a plant from the start.
Scarier.
The backdoor code [arstechnica.com] looks to be the work of someone who learned PHP on Monday.
Scariest.
Honestly, the only way it could have been more obvious is if the file was called backdoor.php. There was no attempt made to disguise the location or what the code was doing which is why it got caught so quickly. A complete amateur got caught with control over a chunk of Sourceforge downloads. In computer security when you find a breach you don't just close the obvious point of entry, you have to take a big step back and seriously ask 'what else was compromised'. In this case the big question is who else.
If this clown could do it and didn't get caught until an end user saw the stupidly obvious file and its stupidly obvious code (as opposed to a server log or other Sourceforge audit turning it up) what are the competent hackers up to. Real backdoors are blended into the existing code instead of being added as a seperate file. Real backdoors are designed to be hidden from casual inspection instead being completely obvious in their function and 'I don't belong here status'. Really good backdoors are designed to not look like intentionally malicious code even after they are found (ex. the wait4 backdoor attempt in the Linux kernel was pretty good, it got caught because the CVS hack used to insert it in a regional CVS mirror was flawed in several ways that raised alarms).
So, what kind of security/procedure/audit could have been in place, needs to be in place, so that something like this will raise an alarm even when the hacker isn't the most incompetent backdoor author in history? What kind of audit is needed to be sure it hasn't already happened?
Re: (Score:2)
My biggest concern as someone who has a SF project out there (albeit decrepit), is what auditing/security measures does SF employ to screen their mirroring hosts? You'd think that there would at least be some high-level auditing performed to ensure that all of the open source code is somewhat secure...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
You're close, except:
A widely used web package has a backdoor inserted.
is mostly incorrect, it wasn't the phpMyAdmin project, it wasn't that the source code was compromised; the problem is that one specific mirror was compromised and a modified copy of the phpMyAdmin source was distributed instead of the official files. It's a stretch to blame that on the phpMyAdmin project.
So, what kind of security/procedure/audit could have been in place, needs to be in place, so that something like this will raise an alarm even when the hacker isn't the most incompetent backdoor author in history? What kind of audit is needed to be sure it hasn't already happened?
I'm thinking of some sort of mathematical function where you plug in an arbitrary number of bits, say an entire file, and get out a small representation that is very, very difficult to
how far? (Score:4)
My question is when the backdoor gives full access to the hacker, what is the extent of compromise? Does it give you all data but you cannot read the passwords ? Do you have the ability to decrypt passwords by gaining root access with this or is the data still protected?
Forgive my ignorance
Strange choice (Score:2)
Does anyone put a phpmyadmin open to the world? Not just passworded but on a port that is firewalled off from all but a set of trusted ips???
I guess it has PHP in the name so probably some idiots do.
Hardened PHP -- Suhosin (Score:2)
The backdoor was basically an eval that ran anything posted to it (according to the Ars article posted up thread [arstechnica.com]). On my web host, Suhosin [hardened-php.net] is enabled by default, and setup to block eval from ever running.
I.e. Even if I had installed this bad version of PhpMyAdmin, I would not have anything to worry about with regards that eval statement. So, security hey. It's hard, but not that hard.
Mirrors are problematic (Score:2)
A simpler alternative to phpMyAdmin (Score:2)