10 ms·
Php.net detected as a malware host by Google Safe Browsing
- okonomiyaki3000 13y agoYeah, what gives?
- nathancahill 13y agoInteresting that satnavreviewed.co.uk, obbcountybankruptcylawyer.com, stephaniemari.com, and northgadui.com are all owned by the same GoDaddy account.
- tobyjsullivan 13y agoYeah, presumably the one godaddy account got hijacked, then used as a host for the malicious file. A good reminder that anyone's low-profile website may not seem a tempting target, but it's still very much at risk.
- srajbr 13y agowhats the news from http://php.net/ http://php.net/ webmaster???
- dingdingdang 13y agoyup, can we please have some official voice provide a bit of background data here?!
- bhhaskin 13y agoOne reason I migrated away from php is the fact that there is simply way too many attack vectors. Using frameworks help quite a bit, but it is to easy to miss configure a stock php install. Not saying that is the case here though.
- thejosh 13y agocurious what you are using now?
- bhhaskin 13y agoCurrently using Django. Once I started playing around with it I haven't looked back. Although I am told cake php and a few other frameworks really do improve php.
- hwh 13y agoI'm tempted to say: they improve programmers.
- camus2 13y agothey dont improve PHP. you still have to deal with PHP shortcomings even with a framework. But since you dont deal with low level stuffs your code might be more secure yeah. PHP has too many unsecure apis accessible to beginners. With Django for instance you have a view layer with auto escaping by default.You dont write unsecure SQL queries ,..., That makes a huge difference.
- topac 13y agowe have no proofs that is related with the fact that the domain has been blacklisted by google
- bhhaskin 13y agoYou are correct. Like I said, I doubt that is the case. Php can be very secure if configured correctly.
- camus2 13y agothat's the issue, PHP should be secure(ie restrictive) by default, Linux style... it is not. PHP+Apache => recipe for disaster. PHP is a templating language yet doesnt do html sanitizing by default ! 95% of compromised websites are PHP ones. That's the reason why PHP will die eventually,when businesses understand while it's cheap to go online with a PHP cms, once you get hacked , it will cost you your business.
- deleted 13y ago[deleted]
- KamiNuvini 13y agoThey're working on it: http://productforums.google.com/forum/#!topic/webmasters/puLmvjtK0m8 http://productforums.google.com/forum/#!topic/webmasters/puL...
- guard-of-terra 13y agoMalware detectors are usually right if overzealous.
- jes 13y agoHey, PHP isn't perfect, but calling it malware seems over the top! /rimshot Thank you, thank you, ladies and gentlemen, I'll be here all week!
- topac 13y agoba dum tss
- jayzalowitz 13y agoBut in all seriousness, php is not the bad guy here, bad coders are.
- deleted 13y ago[deleted]
- dscrd 13y agoAre you referring to the people who implemented PHP? Because I would be.
- alphadevx 13y agoThis is what happens when you give too much power to one company. And what is the appeal process? Asking for help on Twitter as the founder of a huge project like PHP? https://twitter.com/rasmus/status/393258264034422785 https://twitter.com/rasmus/status/393258264034422785
- eugenesu 13y agoWebMaster Tools really need some improvements - there is no way to re-scan suspected page fast and get more info about the issue. If even Rasmus was unable to get this resolved fast, imagine regular webmasters in the same situation.
- dchest 13y agoThis is what happens when you give too much power to one company. What happens? Is it bad that that Google protects users from malware and notifies webmasters that their website was compromised?
- alphadevx 13y agoIt's very heavy handed. It has not been 100% verified that the site was compromised, and a lot of very technically smart PHP community members are looking hard at this. It may prove to be a false positive or otherwise, but in the meantime: 1. Google is blocking access to the site in Chrome. 2. Firefox is warning users that php.net is not to be trusted (it uses the same list of infected sites provided by Google). 3. Google is warning users on Google Search that "This site may harm your computer.". 4. Google's appeals process is slow and cumbersome. So yeah, that is a lot of power for one company. If this happened to your website due to, for example a false positive, you would be pretty unhappy. Only a high profile project like PHP gets this kind of attention, but I'd happily wager that many smaller websites suffer the same faith every day.
- dchest 13y agoThis is exactly what happens when your website serves malware. Unhappy about it? Don't serve malware from your website.
- deleted 13y ago[deleted]
- dancecodes 13y agoit is not surprised
- dancecodes 13y agowhy? see sources of project php.net for this site
- maxk42 13y agoIf someone managed to compromise something like the PHP binaries they could cause a lot of damage.
- smsm42 13y agoMain php.net site doesn't have binaries, only sources. windows.php.net has Windows binaries, other sites - like Linux distros - have others. All php releases are signed and checksummed on the d/l page.
- ris 13y agoI wouldn't imagine anyone downloading php binaries from php.net gives the remotest fig about security so I'm not sure why it would matter.
- curiousquestion 13y agohttp://php.mirrors.pair.com/ http://php.mirrors.pair.com/
- smsm42 13y agoThat's a pretty outdated mirror :)
- curiousquestion 13y ago7 months in "web years" is pretty old, but as you know PHP has been around a long time, so there's still alot of relevant information for those who depend on the site.
- deleted 13y ago[deleted]
- bmfet 13y agoI'd say the tool is broken: http://www.google.com/safebrowsing/diagnostic?site=http://google.com http://www.google.com/safebrowsing/diagnostic?site=http://go... It reports google.com for 142 exploit(s), 131 trojan(s), 98 scripting exploit(s)
- smsm42 13y agoFor php.net, it reports only mere 4 trojans. So php.net is almost 100 times safer that google.com, according to this tool. That sounds pretty good :)
- camus2 13y ago> For php.net, it reports only mere 4 trojans. So php.net is almost 100 times safer that google.com, according to this tool. That sounds pretty good :) Compare how many google.com pages have been tested and how much php.net pages have been tested and stop with that non sense.
- skj 13y agoYou are confident enough in Google's ability to have perfect security on all pages that you think the tool is broken when it says that is not true?
- drzaiusapelord 13y agoThat query probably contains all subpages in google.com, which I imagine have been exploited in some fashion. Google isn't perfect.
- eli 13y agoI'd say you're wrong. Google hosts user-created content that could (and likely did) contain malware at, for example, sites.google.com: http://www.google.com/safebrowsing/diagnostic?site=http://sites.google.com http://www.google.com/safebrowsing/diagnostic?site=http://si...
- ars 13y agoA site I visit frequently was once identified as containing malware. I overrode it and went there anyway. (In firefox.) And now forevermore the icon for that site in the url-bar dropdown is the warning icon, and I have not been able to find out how to change it back to the normal one.
- agilebyte 13y agoExplicitly visit the url of that favicon in the browser and hard reload the page. That usually works for me.
- ars 13y agoThe icon is correct in tabs (and by correct I mean not there - the site has no favicon), it's only incorrect in the url-drop down (the arrow in the url box which shows you the most visited pages).
- ahoge 13y agoFavicion caching is extremely aggressive in Firefox. In the past, visiting the URL of the favicon and pressing Ctrl+F5 was enough. Nowadays, you have clear your cache [1] and then restart your browser. [1] Tools -> Options -> Advanced -> Network -> Cached Web Content -> Clear Now
- jeena 13y agoHm, so is my Firefox getting this list directly from Google or how does it work?
- dangrossman 13y agoYes, Firefox downloads a list of suspicious sites from Google every 30 minutes. It uses the Google Safe Browsing Protocol -- https://code.google.com/p/google-safe-browsing/wiki/Protocolv2Spec https://code.google.com/p/google-safe-browsing/wiki/Protocol...
- eli 13y agoNitpick: it's a list of hashes of suspicious URLs.
- nodesocket 13y agoHonestly, I feel like there is nerd rage here; php.net should in no way ever be flagged as malware. Clearly a failure in Google here.
- brazzy 13y agoNot sure if you're joking or lacking knowledge. Just because it's the official PHP site does absolutey NOT mean it cannot contain malware. Legitimate sites are compromised and used to spread malware all the damn time.
- smsm42 13y agoBut in this case it looks like Google tool found legit, but obfuscated file, which was loaded in some tricky way that bad sites usually use, and decided it's a malware.
- timje1 13y agomysql.com was hacked by a sql injection [0]. microsoft.com had XSS vulnerabilities a while back that allowed auth token harvesting via an overly generous cookie paths [1]. Any website in the world has the potential to be flagged as serving malware. [0] http://www.pcworld.com/article/240609/mysqlcom_hacked_to_serve_malware.html http://www.pcworld.com/article/240609/mysqlcom_hacked_to_ser... [1] http://www.marw0rm.com/xss-flaw-on-office-microsoft-com-discovered-by-a-moroccan-security-researcher/ http://www.marw0rm.com/xss-flaw-on-office-microsoft-com-disc... etc
- dscrd 13y agoEverybody seems to laugh and rage about this, but could somebody tell me if this is correctly detected or not? I would not be surprised at all if somebody had breached php.net. Did they properly check against intrusions?
- alanbyrne 13y agoThis comment by a Google employee seems to suggest that it wasn't incorrectly flagged: http://productforums.google.com/d/msg/webmasters/puLmvjtK0m8/8zxOCgZvyPEJ http://productforums.google.com/d/msg/webmasters/puLmvjtK0m8...
- 001sky 13y agohttp://www.google.com/safebrowsing/diagnostic?site=http://php.net/manual/en/function.next.php&hl=en http://www.google.com/safebrowsing/diagnostic?site=http://ph... direct
- karma_fountain 13y agoIt's weird. The file linked to in the google product forums (http://static.php.net/www.php.net/userprefs.js http://static.php.net/www.php.net/userprefs.js) definitely has a piece of obfuscated js to insert an iframe pointing to http://lnkhere.reviewhdtv.co.uk/stat.htm http://lnkhere.reviewhdtv.co.uk/stat.htm. The actual http://www.php.net/userprefs.js http://www.php.net/userprefs.js does not though.
- smsm42 13y agoIt was changed to un-confuse whatever tool google is using. No version on github has obfuscated contents (see: https://github.com/php/web-php/commits/master/userprefs.js https://github.com/php/web-php/commits/master/userprefs.js) bit it does include another file (https://github.com/php/web-php/commits/master/functions.js https://github.com/php/web-php/commits/master/functions.js) which did have obfuscated contents. Where the version that inserts iframe to uk site came from?
- 13y ago
- FridayWithJohn 13y agoAccording to Twitter post by Rasmus (https://twitter.com/rasmus/status/393258264034422785 https://twitter.com/rasmus/status/393258264034422785) this has been like this for at least 1 day and still has not been fixed. Something tells me that Google has way too much power and the fact that they don't sort out false positives in a timely fashion is really bad.
- dchest 13y agoPHP webmasters didn't fix the issue and you're complaining about Google?
- asdasf 13y agoAccording to one of the people responsible for a software project that has been plagued by security holes for ~15 years, and whose website was hacked, and who hasn't fixed it... Yeah, that's definitely a problem with google alright. Just because the entire PHP team disregards security completely, doesn't mean the consequences of that are google's problem. The fact that they just assume it is a false positive and don't even bother to verify their hacked site is incredible.
- ma2rten 13y agoSo was the site of the Thai Police with information how to get a police clearance. Very confusing. However, it seems to fixed now.
- cryptos 13y agoThis relates to the website, but maybe there should be malware warnings for programming languages too ;-)
- finalight 13y agoif so, that means facebook is also a malware :D
- dlsym 13y agoSure, there are many reasons to dislike PHP. But I wouldn't go as far and call it a malware.
- ebarock 13y agothey should already fixed it, the file that they are mentioning, this "userprefs.js" does it is not harmful
- 16s 13y agoFalse positives are the life of security. Microsoft Updates (update.microsoft.com) was just blacklisted by malwaredomains this week. It happens. Algorithms are not humans.
- 02 13y agoThis was a true positive.
- pierrefar 13y agoI work at Google and was the one who posted on our forums about this. What our systems found was definitely a compromised JS file, and others on this thread have posted something similar to what we saw. This is not a false positive. We have detailed help for webmasters in this kind of situation: http://www.google.com/webmasters/hacked/ http://www.google.com/webmasters/hacked/ One thing that I strongly suggest to any webmaster in this situation is to look for any server vulnerability that allowed this file to get compromised in the first place. We sometimes see webmasters simply fix the affected files without digging into security hole that allowed the hack, which leaves the server vulnerable for repeat attacks. Happy to answer questions.
- deanclatworthy 13y agoThanks for the information. Can you confirm how long the malware has been on the site for, and if it's possible that people may have been drive-by'd before you flagged the domain? Also what systems did the malware target? Thanks
- pierrefar 13y agoWhat we can share publicly is at this diagnostics page accessible to anyone (it's linked from the warning page browsers show): http://www.google.com/safebrowsing/diagnostic?site=http://php.net/ http://www.google.com/safebrowsing/diagnostic?site=http://ph... Verified owners in Webmasters Tools get more info.
- deanclatworthy 13y agoIt's a pity you don't disclose which malware specifically the sites were distributing. As a user who may have been affected prior to google flagging it, it's frustrating to have no information on what to look for.
- nwh 13y agoIt's linked further down the page.
- wil421 13y agoHa I live in Cobb County I wonder if that's a good bankruptcy lawyer.
- edem 13y agoMaybe they used PHP to create the site. :)
- camus2 13y agoWell somebody screwed up here. Maybe PHP core developpers should concentrate on the security of their own website , it's more than embarrassing. There is no reason why php.net should use anything more than a static site generator.
- ds9 13y agoFrom the headers, php.net seems to be Apache/PHP on BSD. This might be an example of a widespread ongoing attack pattern which is a bit of a mystery. For the past year or more there have been compromises in this pattern - Linux/unix platform, Apache webserver; foreign Javascript or PHP gets inserted somehow; and/or in some cases the server binary is replaced. Sample article: http://arstechnica.com/security/2013/04/exclusive-ongoing-malware-attack-targeting-apache-hijacks-20000-sites/ http://arstechnica.com/security/2013/04/exclusive-ongoing-ma... - you can find more on this. The big question is how the original exploit happens. It may be a long-out-there 0-day, or some admin tool that the sites have in common, or credentials taken from compromised boxes of developers, or something else. Edited to update info.
- deleted 13y ago[deleted]
- sarreph 13y agoThis happened to http://www.iphonedevsdk.com http://www.iphonedevsdk.com a while ago and did a good job of tarnishing its reputation, all as a result of an arbitrary flag.
- Hoff 13y agoSerious question: this "arbitrary flag" would possibly be in reference to this widely-reported watering hole attack[1] (or was that attack misreported?), or are you referring to some other issue with that web site? [1] http://arstechnica.com/security/2013/02/dev-site-behind-apple-facebook-hacks-didnt-know-it-was-booby-trapped/ http://arstechnica.com/security/2013/02/dev-site-behind-appl...
- tptacek 13y agoDidn't iphonedevsdk.com end up hosting a clientside exploit that got attackers onto the internal networks of Facebook and Twitter?
- dpeck 13y agoThere seems to be some controversy here, and one of our research systems found the same problem. So heres a quick post and a link to the full pcap so you can see for yourselves. http://barracudalabs.com/2013/10/php-net-compromise/ http://barracudalabs.com/2013/10/php-net-compromise/ Cheers.
- muraiki 13y agoI'm using Firefox 24 for OS X and the vertical bar with social media buttons floats over the center of that site's content, making it unreadable.
- JohnTHaller 13y agoNot sure if you're associated with that site, but it's kinda hard to read that article: http://imgur.com/lyeZ9qZ http://imgur.com/lyeZ9qZ Windows, Firefox 24.0
- dpeck 13y agough, yeah, I'm just a bit associated with it :) I think our social media coordinator got a little happy with the options. For now disable JS to get a nice read, I'll see about getting that fixed. EDIT: fixed, looks like last update of WP-Socializer introduced the bug. Disabled for the time being. Thank you and sibling poster for pointing it out.
- LawnGnome 13y agoAn update has been posted on this: http://php.net/archive/2013.php#id2013-10-24-1 http://php.net/archive/2013.php#id2013-10-24-1 tl;dr: Relevant services moved to new servers; investigation continuing. Post mortem to follow once that's done.
- igl00 13y agostill funny ;)