Php.net detected as a malware host by Google Safe Browsing

http://www.google.com/safebrowsing/diagnostic?site=http://php.net/manual/en/function.next.php&hl=en

by nivla • 13 years ago

176 166 13 years ago

Yeah, what gives?

Interesting that satnavreviewed.co.uk, obbcountybankruptcylawyer.com, stephaniemari.com, and northgadui.com are all owned by the same GoDaddy account.

tobyjsullivan• 13 years ago

Yeah, presumably the one godaddy account got hijacked, then used as a host for the malicious file.

A good reminder that anyone's low-profile website may not seem a tempting target, but it's still very much at risk.

srajbr• 13 years ago

whats the news from http://php.net/ webmaster???

dingdingdang2• 13 years ago

yup, can we please have some official voice provide a bit of background data here?!

bhhaskin6• 13 years ago

One reason I migrated away from php is the fact that there is simply way too many attack vectors. Using frameworks help quite a bit, but it is to easy to miss configure a stock php install. Not saying that is the case here though.

thejosh• 13 years ago

curious what you are using now?

bhhaskin6• 13 years ago

Currently using Django. Once I started playing around with it I haven't looked back. Although I am told cake php and a few other frameworks really do improve php.

topac2• 13 years ago

we have no proofs that is related with the fact that the domain has been blacklisted by google

bhhaskin6• 13 years ago

You are correct. Like I said, I doubt that is the case. Php can be very secure if configured correctly.

acqq• 13 years ago

It's "tagged" by Google. When I search php from the iPhone I get:

"PHP: Hypertext Preprocessor

php.net/

This site may harm your computer.

Server-side HTML embedded scripting language. It provides web developers with a full suite of tools for ..."

Google inserts the "harm" note.

dancecodes4• 13 years ago

when many attacks are occurs it is going more interesting...

dancecodes4• 13 years ago

and you now using sql-prepare-query instructions after escape from php?

bhhaskin6• 13 years ago

Using Django ORM. if you haven't used an ORM before you are missing out.

krapp• 13 years ago

... you know PHP's supported PDO for a while now, right?

dkloke• 13 years ago

you do realize that this is a javascript exploit? just sayin.

ubersoldat2k7• 13 years ago

You'd have to be pretty stupid to think this is exploting some sort of PHP bug.

OMG! Did I just defend PHP? Gotta go take my medication.

camus27• 13 years ago

and how did the js exploit end up on their servers? through php code likely.

bhhaskin6• 13 years ago

Yes. It was more of a general statement.

KamiNuvini• 13 years ago

They're working on it: http://productforums.google.com/forum/#!topic/webmasters/puL...

guard-of-terra• 13 years ago

Malware detectors are usually right if overzealous.

jes• 13 years ago

Hey, PHP isn't perfect, but calling it malware seems over the top! /rimshot

Thank you, thank you, ladies and gentlemen, I'll be here all week!

topac2• 13 years ago

ba dum tss

jayzalowitz• 13 years ago

But in all seriousness, php is not the bad guy here, bad coders are.

alphadevx3• 13 years ago

This is what happens when you give too much power to one company. And what is the appeal process? Asking for help on Twitter as the founder of a huge project like PHP? https://twitter.com/rasmus/status/393258264034422785

eugenesu• 13 years ago

WebMaster Tools really need some improvements - there is no way to re-scan suspected page fast and get more info about the issue. If even Rasmus was unable to get this resolved fast, imagine regular webmasters in the same situation.

dchest6• 13 years ago

This is what happens when you give too much power to one company.

What happens? Is it bad that that Google protects users from malware and notifies webmasters that their website was compromised?

alphadevx3• 13 years ago

It's very heavy handed. It has not been 100% verified that the site was compromised, and a lot of very technically smart PHP community members are looking hard at this. It may prove to be a false positive or otherwise, but in the meantime:

1. Google is blocking access to the site in Chrome.

2. Firefox is warning users that php.net is not to be trusted (it uses the same list of infected sites provided by Google).

3. Google is warning users on Google Search that "This site may harm your computer.".

4. Google's appeals process is slow and cumbersome.

So yeah, that is a lot of power for one company.

If this happened to your website due to, for example a false positive, you would be pretty unhappy. Only a high profile project like PHP gets this kind of attention, but I'd happily wager that many smaller websites suffer the same faith every day.

bowlofpetunias• 13 years ago

Google doesn't notify anybody, you have to find out for yourself the hard way.

And after that, it forces the owners of the site to register with Google and use Google services just to even figure out why, and to get their sites unflagged. And that is after the owner even figured out how and where to contact Google.

dancecodes4• 13 years ago

it is not surprised

dancecodes4• 13 years ago

why? see sources of project php.net for this site

maxk42• 13 years ago

If someone managed to compromise something like the PHP binaries they could cause a lot of damage.

smsm426• 13 years ago

Main php.net site doesn't have binaries, only sources. windows.php.net has Windows binaries, other sites - like Linux distros - have others.

All php releases are signed and checksummed on the d/l page.

ris• 13 years ago

I wouldn't imagine anyone downloading php binaries from php.net gives the remotest fig about security so I'm not sure why it would matter.

curiousquestion2• 13 years ago

http://php.mirrors.pair.com/

smsm426• 13 years ago

That's a pretty outdated mirror :)

curiousquestion2• 13 years ago

7 months in "web years" is pretty old, but as you know PHP has been around a long time, so there's still alot of relevant information for those who depend on the site.

bmfet• 13 years ago

I'd say the tool is broken:

http://www.google.com/safebrowsing/diagnostic?site=http://go...

It reports google.com for 142 exploit(s), 131 trojan(s), 98 scripting exploit(s)

smsm426• 13 years ago

For php.net, it reports only mere 4 trojans. So php.net is almost 100 times safer that google.com, according to this tool. That sounds pretty good :)

camus27• 13 years ago

For php.net, it reports only mere 4 trojans. So php.net is almost 100 times safer that google.com, according to this tool. That sounds pretty good :)

Compare how many google.com pages have been tested and how much php.net pages have been tested and stop with that non sense.

skj• 13 years ago

You are confident enough in Google's ability to have perfect security on all pages that you think the tool is broken when it says that is not true?

drzaiusapelord2• 13 years ago

That query probably contains all subpages in google.com, which I imagine have been exploited in some fashion. Google isn't perfect.

eli2• 13 years ago

I'd say you're wrong. Google hosts user-created content that could (and likely did) contain malware at, for example, sites.google.com: http://www.google.com/safebrowsing/diagnostic?site=http://si...

ars3• 13 years ago

A site I visit frequently was once identified as containing malware. I overrode it and went there anyway. (In firefox.)

And now forevermore the icon for that site in the url-bar dropdown is the warning icon, and I have not been able to find out how to change it back to the normal one.

agilebyte• 13 years ago

Explicitly visit the url of that favicon in the browser and hard reload the page. That usually works for me.

ars3• 13 years ago

The icon is correct in tabs (and by correct I mean not there - the site has no favicon), it's only incorrect in the url-drop down (the arrow in the url box which shows you the most visited pages).

ahoge• 13 years ago

Favicion caching is extremely aggressive in Firefox. In the past, visiting the URL of the favicon and pressing Ctrl+F5 was enough. Nowadays, you have clear your cache [1] and then restart your browser.

[1] Tools -> Options -> Advanced -> Network -> Cached Web Content -> Clear Now

jeena• 13 years ago

Hm, so is my Firefox getting this list directly from Google or how does it work?

dangrossman• 13 years ago

Yes, Firefox downloads a list of suspicious sites from Google every 30 minutes. It uses the Google Safe Browsing Protocol --

https://code.google.com/p/google-safe-browsing/wiki/Protocol...

eli2• 13 years ago

Nitpick: it's a list of hashes of suspicious URLs.

nodesocket• 13 years ago

Honestly, I feel like there is nerd rage here; php.net should in no way ever be flagged as malware. Clearly a failure in Google here.

brazzy• 13 years ago

Not sure if you're joking or lacking knowledge. Just because it's the official PHP site does absolutey NOT mean it cannot contain malware. Legitimate sites are compromised and used to spread malware all the damn time.

smsm426• 13 years ago

But in this case it looks like Google tool found legit, but obfuscated file, which was loaded in some tricky way that bad sites usually use, and decided it's a malware.

timje1• 13 years ago

mysql.com was hacked by a sql injection [0]. microsoft.com had XSS vulnerabilities a while back that allowed auth token harvesting via an overly generous cookie paths [1].

Any website in the world has the potential to be flagged as serving malware.

[0] http://www.pcworld.com/article/240609/mysqlcom_hacked_to_ser... [1] http://www.marw0rm.com/xss-flaw-on-office-microsoft-com-disc... etc

dscrd3• 13 years ago

Everybody seems to laugh and rage about this, but could somebody tell me if this is correctly detected or not? I would not be surprised at all if somebody had breached php.net. Did they properly check against intrusions?

alanbyrne• 13 years ago

This comment by a Google employee seems to suggest that it wasn't incorrectly flagged:

http://productforums.google.com/d/msg/webmasters/puLmvjtK0m8...

001sky• 13 years ago

http://www.google.com/safebrowsing/diagnostic?site=http://ph...

direct

karma_fountain4• 13 years ago

It's weird. The file linked to in the google product forums (http://static.php.net/www.php.net/userprefs.js) definitely has a piece of obfuscated js to insert an iframe pointing to http://lnkhere.reviewhdtv.co.uk/stat.htm. The actual http://www.php.net/userprefs.js does not though.

smsm426• 13 years ago

It was changed to un-confuse whatever tool google is using. No version on github has obfuscated contents (see: https://github.com/php/web-php/commits/master/userprefs.js) bit it does include another file (https://github.com/php/web-php/commits/master/functions.js) which did have obfuscated contents. Where the version that inserts iframe to uk site came from?

CornishPasty• 13 years ago

Both files appear identical to me. Which is odd, since there is only 1 CNAME to an address with 1 A record. Perhaps your version of static.php.net is cached by your ISP?

ars3• 13 years ago

Not for me. Both urls have exactly the same content, and nothing suspicious.

Could this be a DNS issue, with a different server serving the bad .js file?

My IP for static.php.net is 69.147.83.201.

FridayWithJohn4• 13 years ago

It is a false positive as can be seen here: https://twitter.com/rasmus/status/393258147025932288/photo/1 Bascially it is complaining about a JS file that is actually meant to be there.

icebraining• 13 years ago

What if the JS file itself was replaced?

Guvante2• 13 years ago

Only if you misread the message, Google is saying "the following piece of code injects things", not "this is the exact code that injects things".

babawere2• 13 years ago

Its was definitely hacked .. the log shows that the size of userprefs.js has definitely changed multiple times in the past 25 hrs : http://lerdorf.com/static.log.gz

junto• 13 years ago

The site that is linked to in the obfuscated code is http://lnkhere.reviewhdtv.co.uk/stat.htm and it is that site which Google has marked as unsafe. Php.net has received the malware warning as a result.

http://safebrowsing.clients.google.com/safebrowsing/diagnost...

Notably the whois on that domain includes the registrants full name and address. Nominet allows personal registrants an opt-out on the full details in whois, so you would be unlikely to try and hack PHP.net and forget to use a privacy service on a domain name that isn't quite so traceable..

The domain record for that site show:

  Domain name:
      reviewhdtv.co.uk
 
  Registrant:
      Oli Bachini
 
  Registrant type:
      UK Individual
 
  Registrant's address:
      Rainbow Cottage
      West Perry
      Huntingdon
      Cambs
      PE28 0BX
      United Kingdom
 
  Registrar:
      Webfusion Ltd t/a 123-reg [Tag = 123-REG]
      URL: http://www.123-reg.co.uk
 
  Relevant dates:
      Registered on: 13-Oct-2010
      Expiry date:  13-Oct-2014
      Last updated:  06-Oct-2012
 
  Registration status:
      Registered until expiry date.
 
  Name servers:
      ns.123-reg.co.uk
      ns2.123-reg.co.uk
 
  WHOIS lookup made at 11:44:39 24-Oct-2013

rurban• 13 years ago

Whow

  $ zcat ~/Downloads/static.log.gz |
  perl -lne'if (m/ 200 (\d+)/) { print $1 }'|sort |uniq -c
    390 0
    523 10881
    639 12479
  16276 1279
 178111 2602
      1 4071
     14 4072
     63 4801
    112 4812
   9431 5097
  27654 5821
    110 5911
   1348 6008
    162 7884
    256 8278
    568 9035
   1103 9634

That's a lot of changes

FridayWithJohn4• 13 years ago

According to Twitter post by Rasmus (https://twitter.com/rasmus/status/393258264034422785) this has been like this for at least 1 day and still has not been fixed. Something tells me that Google has way too much power and the fact that they don't sort out false positives in a timely fashion is really bad.

dchest6• 13 years ago

PHP webmasters didn't fix the issue and you're complaining about Google?

asdasf• 13 years ago

According to one of the people responsible for a software project that has been plagued by security holes for ~15 years, and whose website was hacked, and who hasn't fixed it...

Yeah, that's definitely a problem with google alright. Just because the entire PHP team disregards security completely, doesn't mean the consequences of that are google's problem. The fact that they just assume it is a false positive and don't even bother to verify their hacked site is incredible.

ma2rten• 13 years ago

So was the site of the Thai Police with information how to get a police clearance. Very confusing. However, it seems to fixed now.

cryptos• 13 years ago

This relates to the website, but maybe there should be malware warnings for programming languages too ;-)

finalight• 13 years ago

if so, that means facebook is also a malware :D

camus27• 13 years ago

facebook hardly uses the PHP interpretor,they have their own PHP VM , HHVM.

wyck2• 13 years ago

Considering the compromise was a js script and most likely had nothing to do with PHP, both these comments are not relevant.

dlsym• 13 years ago

Sure, there are many reasons to dislike PHP. But I wouldn't go as far and call it a malware.

ebarock• 13 years ago

they should already fixed it, the file that they are mentioning, this "userprefs.js" does it is not harmful

16s• 13 years ago

False positives are the life of security. Microsoft Updates (update.microsoft.com) was just blacklisted by malwaredomains this week. It happens. Algorithms are not humans.

02• 13 years ago

This was a true positive.

pierrefar2• 13 years ago

I work at Google and was the one who posted on our forums about this.

What our systems found was definitely a compromised JS file, and others on this thread have posted something similar to what we saw. This is not a false positive.

We have detailed help for webmasters in this kind of situation:

http://www.google.com/webmasters/hacked/

One thing that I strongly suggest to any webmaster in this situation is to look for any server vulnerability that allowed this file to get compromised in the first place. We sometimes see webmasters simply fix the affected files without digging into security hole that allowed the hack, which leaves the server vulnerable for repeat attacks.

Happy to answer questions.

deanclatworthy• 13 years ago

Thanks for the information. Can you confirm how long the malware has been on the site for, and if it's possible that people may have been drive-by'd before you flagged the domain? Also what systems did the malware target?

Thanks

pierrefar2• 13 years ago

What we can share publicly is at this diagnostics page accessible to anyone (it's linked from the warning page browsers show):

http://www.google.com/safebrowsing/diagnostic?site=http://ph...

Verified owners in Webmasters Tools get more info.

bruceboughton3• 13 years ago

From the dignostics page (http://www.google.com/safebrowsing/diagnostic?site=http://ph...):

> Malicious software is hosted on 4 domain(s), including cobbcountybankruptcylawyer.com/, stephaniemari.com/, northgadui.com/.

What does this mean? How do these sites relate to php.net?

ajankovic• 13 years ago

Probably javascript files planted on php.net are being pulled from servers behind those domains.

donrhummy• 13 years ago

php.net allows users to post answers and examples of code throughout the website. Likely, one of the submission forms has/had a hole that allowed someone to submit or alter actual JS code.

Apofis• 13 years ago

This seems like a pretty darn good example of cross-side scripting... and possibly someone not sanitizing inputs?

jimbobsyourmom• 13 years ago

You sir, get -9,001 Internets.

There are huge repercussions for any website that gets blacklisted with the Stop Badware clearinghouse, the least of which is the inability to figure out exactly where the problem actually is because the company you work for's information for a webmaster to resolve the problem is ridiculously minimal. There are no notifications (unless you are signed up for Google Webmaster Tools) and restoring a website to normal globally can take anywhere from 48 hours to two weeks. There are millions of developers who rely on the PHP website daily for performing their day jobs and you've now made it that much harder for us to do our jobs.

Stop Badware needs a serious overhaul. At the very least, they should contact the contacts in the WHOIS record for the domain BEFORE doing anything. Give the website owners 24 hours to resolve the issue before blacklisting the site. And give them a heck of a lot more information to go on than some vague text.

Also, there are several anti-virus vendors out there who use the clearinghouse database for their products...6 to 12 months after the original blacklisting. So this will happen all over again 6 to 12 months from now. Finding contacts for anti-virus vendors for removing domain blocks is a lot harder than removal from the blacklist on the Stop Badware site.

The CORRECT solution for this situation was to find a contact at PHP who could resolve the issue quickly and amicably. Seriously, how hard is it to locate Rasmus' e-mail address? Always try to find a human contact before using Stop Badware. You can chalk using Stop Badware for the PHP website as being the dumbest decision you've made this year. Hopefully this decision of yours will raise the ire of the Internet just enough to force the company you work for to revamp Stop Badware so it doesn't suck, Google Webmaster Tools so they don't suck, and the reporting tools for sending information to Stop Badware so they also don't suck.

furyofantares• 13 years ago

I don't understand your suggestion that Google should have waited to protect their users from a site that is serving malware. Why would that be a good idea?

Silhouette• 13 years ago

Stop Badware needs a serious overhaul. At the very least, they should contact the contacts in the WHOIS record for the domain BEFORE doing anything.

Why? This isn't a responsible disclosure, "we found a potential vulnerability but we don't know if it's being exploited yet" kind of situation. This is a "there's a real threat to anyone visiting that site via your search engine right now" kind of situation.

As a user, I'd be much happier if the search engine flagged this immediately.

As a site owner, if someone found malware on my site I'd want to know ASAP too. Obviously it would be helpful if they sent me a notification and made the specific details of the identified threat available. However, I could hardly criticise them for blacklisting my site while it should be blacklisted, or for claiming that we were dangerous while we were actually serving malware.

Not clearing up the blacklists promptly after the threat is identified and removed is an entirely different question. If you're going to go around blacklisting sites then I think you also have a responsibility (and, for that matter, you should also have a legal obligation) to remove them from the blacklist with similar efficiency if you're notified that the threat has been removed. Claiming that someone's site is dangerous when it isn't is defamatory, and should be treated as such.

skymt• 13 years ago

If Google waited 24 hours before blacklisting a site, how many people would be infected during the grace period?

It's incorrect to say that Google doesn't attempt to contact the site owner. According to the Webmaster Tools support site [0], Google will send notices to several common email addresses when it blacklists a site.

[0] https://support.google.com/webmasters/answer/163633?hl=en#2

dscrd3• 13 years ago

Are you seriously suggesting that Google should not immediately block a website when they detect malware on it... because millions of people are using that site?

camus27• 13 years ago

Seriously, how hard is it to locate Rasmus' e-mail address?

Why should google do that ? because it's Rasmus? they dont have to do that period.

The CORRECT SOLUTION is to protect users FIRST and not allow the site to infect more computers.

IT IS NOT google responsability to warn webmasters if their site are infected (though they can be warned by email automatically).

IT IS the webmaster's responsability to audit his website security, which obviously did not happen with php.net. If they get punished for that , that's FAIR , because it will force them to take security more seriously.

[edit] it's hight time people move from httpd to something else like nginx. httpd is insecure by default, this is not how you deal with security. as for PHP, since it doesnt promote any good security practice by default, it should be avoided.

ryeguy• 13 years ago

Google is not doing this as a service to the website, they are doing it as a service to the user. Giving the owner some kind of grace period to fix the issue could mean hundreds of thousands of people could get hit with a malicious script in the meantime.

You sir, get -9,001 Internets.

Cut this shit out, you're not on reddit.

paraboul• 13 years ago

"We know that your child has a bad contagious cold, but don't worry you can still bring him at school for 24 hours and infects other people"

bitlord_219• 13 years ago

You sir, get -9,001 Internets.

A million times THIS!

joekrill2• 13 years ago

I don't understand: you guys CLEARLY have the information on what, specifically, is causing the problem (which JS file, in this case). Yet for the site owner, you don't make it available? Or if it is, it's not at all easy to find the information. It's just this black box "go figure it out yourself" thing. Meanwhile you've essentially killed access to their site. Or is there something I'm missing?

Guvante2• 13 years ago

They have access to details, they posted that userprefs.js was to blame.

JohnTHaller2• 13 years ago

Once you're a confirmed webmaster for a given site, Google provides you with access to exactly what files are infected on your site. To provide that information publicly would be open the site up to further exploitation.

yeukhon3• 13 years ago

@pierrefar

As a student interested in security, will the js file be provided so we can examine and learn how this was done outside of privileged access?

EDIT

OKay looks like safe browsing said it is no longer suspicious. And I think someone already provided the JS file below.

Google's safe browsing looks pretty cool! Really powerful infrastructure. I wonder if they did this with virustotal? Can virustotal recongize this?

Another thing is other search engines dont seem to have this built-in. I wonder people using DDG will ever think about querying Google safe browsing or not.

Does google provide an api (beside just querying safebrowsing directly).

karma_fountain4• 13 years ago

Here is a pastebin which I found http://pastebin.com/XD0KyLxu

samcrawford• 13 years ago

Does google provide an api (beside just querying safebrowsing directly).

https://developers.google.com/safe-browsing/

wil421• 13 years ago

Ha I live in Cobb County I wonder if that's a good bankruptcy lawyer.

edem• 13 years ago

Maybe they used PHP to create the site. :)

camus27• 13 years ago

Well somebody screwed up here. Maybe PHP core developpers should concentrate on the security of their own website , it's more than embarrassing. There is no reason why php.net should use anything more than a static site generator.

ds9• 13 years ago

From the headers, php.net seems to be Apache/PHP on BSD. This might be an example of a widespread ongoing attack pattern which is a bit of a mystery.

For the past year or more there have been compromises in this pattern - Linux/unix platform, Apache webserver; foreign Javascript or PHP gets inserted somehow; and/or in some cases the server binary is replaced. Sample article: http://arstechnica.com/security/2013/04/exclusive-ongoing-ma... - you can find more on this.

The big question is how the original exploit happens. It may be a long-out-there 0-day, or some admin tool that the sites have in common, or credentials taken from compromised boxes of developers, or something else.

Edited to update info.

sarreph• 13 years ago

This happened to http://www.iphonedevsdk.com a while ago and did a good job of tarnishing its reputation, all as a result of an arbitrary flag.

Hoff• 13 years ago

Serious question: this "arbitrary flag" would possibly be in reference to this widely-reported watering hole attack[1] (or was that attack misreported?), or are you referring to some other issue with that web site?

[1] http://arstechnica.com/security/2013/02/dev-site-behind-appl...

tptacek• 13 years ago

Didn't iphonedevsdk.com end up hosting a clientside exploit that got attackers onto the internal networks of Facebook and Twitter?

dpeck3• 13 years ago

There seems to be some controversy here, and one of our research systems found the same problem. So heres a quick post and a link to the full pcap so you can see for yourselves.

http://barracudalabs.com/2013/10/php-net-compromise/

Cheers.

muraiki2• 13 years ago

I'm using Firefox 24 for OS X and the vertical bar with social media buttons floats over the center of that site's content, making it unreadable.

JohnTHaller2• 13 years ago

Not sure if you're associated with that site, but it's kinda hard to read that article: http://imgur.com/lyeZ9qZ

Windows, Firefox 24.0

dpeck3• 13 years ago

ugh, yeah, I'm just a bit associated with it :)

I think our social media coordinator got a little happy with the options. For now disable JS to get a nice read, I'll see about getting that fixed.

EDIT: fixed, looks like last update of WP-Socializer introduced the bug. Disabled for the time being. Thank you and sibling poster for pointing it out.

LawnGnome• 13 years ago

An update has been posted on this: http://php.net/archive/2013.php#id2013-10-24-1

tl;dr: Relevant services moved to new servers; investigation continuing. Post mortem to follow once that's done.

igl00• 13 years ago

still funny ;)

Php.net detected as a malware host by Google Safe Browsing

Related Stories