6 ms·

Zerodium[0], the magic string searched for in the fake user agent, is a zero-day acquisition platform, in case anyone else is wondering. The third parameter to

Zerodium[0], the magic string searched for in the fake user agent, is a zero-day acquisition platform, in case anyone else is wondering. The third parameter to `zend_eval_string` in the commit [1] is the "filename" [2] of the executed code, which is probably used for stack traces. Which is quite a strange choice, because seeing that in the logs would probably ring alarm bells immediately. Overall, this commit seems strange in its structure IMO - not in a "good" covert way, but in a "why does it not try to hide better" way. EDIT: According to zerodiums charts, this would have been a payout of up to 250k$. However, I'm not quite sure what the attackers plan on cashing out on that would have been, given that the exploit would have quite obviously referenced zerodium and therefore would make the submitter the primary suspect of being the author. Maybe some APT used this "simple" format to disguise the actual power? But then again, it would be in their interest for the exploit to actually go through. [0] https://www.zerodium.com/ https://www.zerodium.com/ [1] https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d#diff-a35f2ee9e1d2d3983a3270ee10ec70bf86349c53febdeabdf104f88cb2167961R370 https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad... [2] https://bugs.php.net/bug.php?id=78224 https://bugs.php.net/bug.php?id=78224 (only mention I found with a documented use of the parameter) [3] https://zerodium.com/program.html https://zerodium.com/program.html

Denvercoder9 6y ago
Zerodium say they have nothing to do with this: https://twitter.com/cBekrar/status/1376469666084757506 https://twitter.com/cBekrar/status/1376469666084757506
- tester34 6y ago
  >Likely, the researcher(s) who found this bug/exploit tried to sell it to many entities but none wanted to buy this crap but why so snarky?
  - pas 6y ago
    twitter. the takes are hotter than the sun, the style is snarkier than zkSNARKs.
- mvolfik 6y ago
  am I understanding it correctly that somebody had breached the PHP git server and tried selling it to 0-day and similar exploiting businesses?
  - Sebb767 6y ago
    That was my assumption given that they explicitly mentioned zerodium. But so far only the commit itself is public, so until we know more about the attack or the attacker, this is pure speculation. The tweet from zerodium is not clear on whether they received an offer for this vulnerability, unfortunately.
- lawl 6y ago
  > Zerodium say they have nothing to do with this Would they admit if they did?
  - fernandotakai 6y ago
    "zerodium investigated zerodium and zerodium found out that zerodium had nothing to do with this"
    - kuroguro 6y ago
      Well the opposite may be true too - the comment may be lying about it having anything to do with zerodium or that date. Could be just a meme or a bad attempt of misdirection in case it went undetected for a while.
  - Sebb767 6y ago
    That's unknown, but it would be strange for them to be involved - it would not make much sense for them to pay out a bounty to themselves. I think it's far more likely that someone tried to plant this there in order to cash out via zerodium.
- tutfbhuf 6y ago
  Maybe the person that reported the exploit to Zerodium already cashed out in mid 2017 and was angry that the exploit hasn't been fixed yet. Therefore, he decided to make it very obvious and force php to react.
  - Angius 6y ago
    I believe the exploit itself was introduced with the commit in question, it wasn't there before.
    - kenmacd 6y ago
      The other exploit, the one that allowed the commit to be injected.
    - toxik 6y ago
      As has been pointed out elsewhere, the exploit is the ability to inject code into the PHP Git repository. Not this RCE.
kenmacd 6y ago
The commits say it was 'sold to zerodium, mid 2017', which would lead me to believe that someone has already been paid for this. I'd say the reason it doesn't hide better is because it's specifically meant not to hide. It's burning the vulnerability that has apparently existed for almost 4 years.
- rst 6y ago
  The vulnerability most people here are talking about was introduced to the PHP codebase last weekend, as part of the block of code containing the "sold... mid 2017" message -- that vuln wasn't there previously, at least in that form. It's not clear what exactly is going on here, but if something was sold to Zerodium in 2017, it wasn't that vuln. So, the message "sold to zerodium, mid 2017" is there, but may not be true -- it might very well be deliberate misdirection.
  - tyingq 6y ago
    Perhaps the vulnerability in the git server that allowed this is what was sold, rather than the commit.
  - kenmacd 6y ago
    I don't see much point in discussing these latest commits. It's very unlikely they were actually malicious in intent (at least to PHP). The vulnerability that is of interest is the one that allowed these commits to be injected. That is what I figure was sold years ago, and was burned recently.
    - insomniacity 6y ago
      Problem is, burning the exploit this way only works if someone does the work to find it. Of course, it could appear in the server logs (or be detailed on a file dumped on the filesystem) - but it seems PHP have just decided to move to Github, and may not actually care about this, so it may not see the light of day.
      - 6y ago

Denvercoder9 6y ago

Zerodium say they have nothing to do with this: https://twitter.com/cBekrar/status/1376469666084757506 https://twitter.com/cBekrar/status/1376469666084757506

tester34 6y ago
>Likely, the researcher(s) who found this bug/exploit tried to sell it to many entities but none wanted to buy this crap but why so snarky?
- pas 6y ago
  twitter. the takes are hotter than the sun, the style is snarkier than zkSNARKs.
mvolfik 6y ago
am I understanding it correctly that somebody had breached the PHP git server and tried selling it to 0-day and similar exploiting businesses?
- Sebb767 6y ago
  That was my assumption given that they explicitly mentioned zerodium. But so far only the commit itself is public, so until we know more about the attack or the attacker, this is pure speculation. The tweet from zerodium is not clear on whether they received an offer for this vulnerability, unfortunately.
lawl 6y ago
> Zerodium say they have nothing to do with this Would they admit if they did?
- fernandotakai 6y ago
  "zerodium investigated zerodium and zerodium found out that zerodium had nothing to do with this"
  - kuroguro 6y ago
    Well the opposite may be true too - the comment may be lying about it having anything to do with zerodium or that date. Could be just a meme or a bad attempt of misdirection in case it went undetected for a while.
- Sebb767 6y ago
  That's unknown, but it would be strange for them to be involved - it would not make much sense for them to pay out a bounty to themselves. I think it's far more likely that someone tried to plant this there in order to cash out via zerodium.
tutfbhuf 6y ago
Maybe the person that reported the exploit to Zerodium already cashed out in mid 2017 and was angry that the exploit hasn't been fixed yet. Therefore, he decided to make it very obvious and force php to react.
- Angius 6y ago
  I believe the exploit itself was introduced with the commit in question, it wasn't there before.
  - kenmacd 6y ago
    The other exploit, the one that allowed the commit to be injected.
  - toxik 6y ago
    As has been pointed out elsewhere, the exploit is the ability to inject code into the PHP Git repository. Not this RCE.

kenmacd 6y ago

The commits say it was 'sold to zerodium, mid 2017', which would lead me to believe that someone has already been paid for this. I'd say the reason it doesn't hide better is because it's specifically meant not to hide. It's burning the vulnerability that has apparently existed for almost 4 years.

rst 6y ago
The vulnerability most people here are talking about was introduced to the PHP codebase last weekend, as part of the block of code containing the "sold... mid 2017" message -- that vuln wasn't there previously, at least in that form. It's not clear what exactly is going on here, but if something was sold to Zerodium in 2017, it wasn't that vuln. So, the message "sold to zerodium, mid 2017" is there, but may not be true -- it might very well be deliberate misdirection.
- tyingq 6y ago
  Perhaps the vulnerability in the git server that allowed this is what was sold, rather than the commit.
- kenmacd 6y ago
  I don't see much point in discussing these latest commits. It's very unlikely they were actually malicious in intent (at least to PHP). The vulnerability that is of interest is the one that allowed these commits to be injected. That is what I figure was sold years ago, and was burned recently.
  - insomniacity 6y ago
    Problem is, burning the exploit this way only works if someone does the work to find it. Of course, it could appear in the server logs (or be detailed on a file dumped on the filesystem) - but it seems PHP have just decided to move to Github, and may not actually care about this, so it may not see the light of day.
    - 6y ago