HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED 2 MINUTES AGO.
You are here: Home / Apple/Mac / PHP.net Servers Dished Out Malware
Powered by Verisign:
Cloud-based solution to improve Your DDoS Attack Readiness.
Click here to learn more.
PHP.net Servers Compromised, Dished Out Malware
PHP.net Servers Compromised, Dished Out Malware
By Adam Dickter / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
OCTOBER
25
2013
The Web site for the popular PHP server-side scripting language had two of its servers compromised by malware, red-faced administrators said on Thursday.

"[T]he php.net systems team have audited every server operated by php.net and have found that two servers were compromised," the company said in a blog post. PHP had initially claimed that it was flagged by the security settings of Google's Chrome and Mozilla Firefox as a false positive, saying Google was slow to provide answers as to why visiting the site produced the following warning:

"This web page at php.net has been reported as an attack page and has been blocked based on your security preferences."

Attack Page

Google's Safe Browsing service posted an explanation, saying "Of the 2428 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent." Google said the malicious software included four Trojan horse-type attacks, was hosted on four domains, and three domains appeared to be functioning as intermediaries distributing malware to visitors of php.net.

As of Friday afternoon, Google said the site "is not currently listed as suspicious."

PHP said the two servers compromised hosted the php.net, static.php.net and git.php.net domains. "All affected services have been migrated off those services," the company said. "We have verified that our Git repository was not compromised and it remains in read only mode as services are brought back up."

Chester Wisniewski, a Toronto-based cybersecurity expert for Sophos International, noted that while PHP.net does not have a long history of harboring malicious content, the PHP programming language "has had a very troubled past with regards to security vulnerabilities and being difficult to code in safely." He noted that the language is used for such popular blogging platforms as WordPress and utilities like PHPMyAdmin.

"It appears whoever compromised the server was simply using its popularity to distribute malware, rather than specifically targeting the PHP source code itself," Wisniewski said.

"The malicious JavaScript was pointing to a popular exploit kit called Magnitude. The malware downloaded from kits like these can change based on your operating system or even your location, so it is difficult to say what type of threat was posed to visitors."

Loose Controls and Monitors?

He added that the PHP team's uncertainty about how the bad code was implanted was worrisome. "You would expect a website in the Alex top 250 to have appropriate monitors and controls in place to trace back what happened. Time will tell if that is the case."

PHP said in its news post, "We will provide a full postmortem in due course, most likely next week," adding that updates would come from the company's official Twitter feed, @official_php.

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.
MORE IN APPLE/MAC
Product Information and Resources for Technology You Can Use To Boost Your Business

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.