Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

Jelle Raaijmakers:
Dissecting a spammer’s spam script
Apr 19, 2016 @ 13:48:37

In this post to his site Jelle Raaijmakers dives into a script that's commonly injected into vulnerable sites and used by spammers to send messages without the knowledge of the site owner.

Let’s take a look at a PHP script used to send spam. These types of scripts run on servers all over the world and might give you some insight into a spammer’s dedication to annoy the hell out of you. Spammers abuse known flaws in unsecured websites and applications to break into a server and install scripts that are able to send loads of spam.

[...] Everyone running a mildly popular WordPress site knows that exploits can be really easily introduced by installing plugins from a less than reputable source – or by not keeping your plugins up to date. Sometimes, a zero-day exploit for a popular WordPress plugins becomes known and thousands of installations worldwide are infected at once.

He then goes through a script he found in an infected WordPress instance of his own on a shared hosting provider. He talks about what these kinds of scripts usually look like (an encoded eval injected into current scripts) and the process he followed to dissect it:

  • Step 1: determine method of obfuscation
  • Step 2: introduce newlines
  • Step 3: replace the $j10 values
  • Step 4: concatenate constant strings
  • Step 5: replace function invocations
  • Step 6: prettify the PHP code
  • Step 7: remove default $j10 argument
  • Step 8: decode the $pate payload
  • Step 9: replace $_POST references
  • Step 10: map function and variable names

It's not a super simple process, but in the end he's left with the complete PHP script that loads a remotely defined configuration, tries to send the emails and even retries if there's a failure. He includes a few noteworthy things about the script including STMP connection auto-detection and DNS lookups over UDP.

tagged: spammer script dissection reverse engineer email spam security

Link: https://jelleraaijmakers.nl/2016/04/dissecting-spammers-spam-script

Paragon Initiative:
Securely Implementing (De)Serialization in PHP
Apr 18, 2016 @ 11:58:22

The Paragon Initiative site has a new tutorial posted aiming to help you more securely use the serialize and unserialize handling in PHP to prevent security issues. In this tutorial they offer some advice - mainly don't unserialize unless you're on PHP7 - and some other solutions you could use.

A frequent problem that developers encounter when building web applications in PHP is, "How should I represent this data structure as a string?" Two common examples include:
  • Caching a complex data structure (to reduce database load)
  • Communicating API requests and responses between HTTP-aware applications
This seems like the sort of problem that you could expect would have pre-existing, straightforward solutions built into every major programming language that aren't accompanied by significant security risk. Sadly, this isn't the case.

He starts with a look at the serialization handling and how it could allow remote code execution if an attacker were to modify the serialized data. He includes an example of using the new "allowed classes" parameter in PHP 7 too, though, preventing the issue. He also walks through two other ways you could replace serialized data: JSON structure and XML handling. Each of these have their own issues too but they're very different than the code execution with serialization.

tagged: serialize unserialize security json xml tutorial example vulnerability

Link: https://paragonie.com/blog/2016/04/securely-implementing-de-serialization-in-php

PHP.net:
PHP 5.6.20 & 5.5.34 Released
Apr 01, 2016 @ 09:22:01

The main PHP.net site has officially announced the release of the latest versions in the PHP 5.5.x and 5.6.x series: PHP 5.6.20 and PHP 5.5.34.

The PHP development team announces the immediate availability of PHP [5.6.20 and 5.5.34]. This is a security release. Several security bugs were fixed in this release. All PHP [5.6 and 5.5] users are encouraged to upgrade to this version.

These releases fix issues in several parts of the language including Curl handing, Fileinfo, Mbstring and ODBC. You can get these latest versions from the main downloads page or windows.php.net for the Windows binaries.

tagged: language release php56 php55 bugfix security update download

Link: http://php.net/archive/2016.php#id2016-03-31-4

AppDynamics PHP Blog:
Predicting the Future of PHP Security – Part 3
Mar 24, 2016 @ 09:30:15

On the AppDynamics blog there's a post from Omed Habib where he looks at the current state of security in the PHP language and makes predictions about the future of it in PHP and where the language might be heading.

In some ways security is an infinite game of chess on a board the size of the world. For every move you make, the hackers have a countermove ready. They are highly motivated to take what you have, so the game never ends; it just switches players once in awhile. In this final blog in the series, we are going to review the game board, with a look at the most recent changes to security in PHP 7 and earlier supported versions. Then, we’ll try to look a few moves ahead with predictions for the future of PHP security.

In the article he talks about PHP's popularity and how it has somewhat worked against it and its reputation when it comes to secure development. He covers PHP 7 and some of the security-related updates that came with it including:

  • whitelisting classes on unserialize
  • the cryptographically secure random number generator
  • patches for buffer overflows and memory leaks

He ends the post looking at a possible future of the language based on comments made in this other article., suggesting that one possible place for the language to head is into the IoT (Internet of Things) space and interacting with the devices on the other end.

tagged: predictions security language php7 features patches iot direction

Link: https://blog.appdynamics.com/php/predicting-the-future-of-php-security/

PHP.net:
PHP 5.5.33, 5.6.19 & 7.0.4 Released
Mar 04, 2016 @ 12:38:49

The latest releases of all major (and minor versions) of the PHP language have been released with several bugfixes including correcting a few security issues: 5.5.33, 5.6.19 and 7.0.4.

The PHP development team announces the immediate availability of PHP [5.5.33, 5.6.19 and 7.0.4]. This is a security release in which two security bugs were fixed. All PHP users are encouraged to upgrade to this version.

You can find out more information about what changes were made in these releases in the PHP 5 Changlog and PHP 7 Changelog along with references to the related bug information. As always, you can download these latest releases from the main PHP.net site or your favorite mirror linked from the main downloads page. Windows users can get the latest binaries from windows.php.net.

tagged: language release php5 php7 bugfix security issue

Link: http://php.net/downloads

Aaron Saray:
Two Quick Tips for Securing PHP Sessions
Feb 15, 2016 @ 09:41:47

In a new post to his site Aaron Saray has shared two tips that can help you protect the information in your PHP sessions - two configuration options to enable that can enforce stricter standards and options enhancing their overall security.

Let’s talk a little bit about session fixation in PHP. Such a fun topic, right? Tons to get into here. But, let’s just touch the surface on two VERY SIMPLE things you can be doing now to make sure that your website is safe.

The two configuration options he mentions are ones that:

  • force the session identifier to use cookies (versus also allowing it from the URL)
  • enforce "strict mode" on the sessions

Each comes with a bit of description as to what the setting does and the recommended setting is to provide the most protection. One note, though: strict mode is only included in PHP 5.5.2 or greater.

tagged: session security tip strict mode cookies useonly phpini configuration setting

Link: http://aaronsaray.com/2016/two-quick-tips-for-securing-php-sessions

Alejandro Celaya:
How to properly implement persistent login
Feb 10, 2016 @ 10:55:37

In his latest post to his site Alejandro Celaya shares some suggestions about how to make a good, safe persistent login feature for your application. This is usually referred to as the "remember me" handling and is widely used to help improve the overall user experience.

I'm sure you are familiar with those "remember me" checkboxes in login forms. They are a common way to allow a user to keep his/her session in a web application for an extended period of time when he is in a trusted computer.

One could think that it is a small and easy-to-implement feature, but it has indeed a lot of considerations. [...] In this article I’m not going to show you how to implement a persistent login in one or another programming language, but what are the good practices that should be followed when you implement it in the way you want.

He starts off with some thoughts about the wrong way to handle the persistent login (like just making a long-life cookie) and what some of the consequences could be. Instead he suggests using a cookie (with a random generated token) that's long running, maybe 2 weeks. The difference here is that this token is then refreshed once the token is validated and reset. This reduces the risk of an older token being used on another source too. He also shares some other security concerns to think about in this setup including the use of one-time tokens, potential multiple persistent sessions and when it might be good to re-prompt for the password.

tagged: persistent login security rememberme implementation advice options

Link: http://blog.alejandrocelaya.com/2016/02/09/how-to-properly-implement-persistent-login/

Marc Morera:
You Probably Need Bundle Dependencies
Feb 10, 2016 @ 09:04:18

In this post to his site Marc Morera responds to some comments from another post about bundles dependencies in Symfony-based applications.

This post tries to answer the Magnus Nordlander’s blog post, and to explain why the Symfony Bundle Dependencies is not just a personal project to fulfill my bundles dependencies, but a practice we should implement in all our Symfony bundles as well.

Believe me, I had a big post to explain why people really need this bundle, but I think that you don’t need these words, but a simple and real example.

He points out a more "real world" example of why this kind of dependency system can be useful in Symfony development. He points out a common service (security.encoder_factory) that's used widely across many bundles, but also defined as a dependency in each. If the bundle dependency structure/tool was in wide use, this dependency would be define elsewhere and not as a part of the bundle itself.

tagged: bundle dependencies symfony security factory example

Link: http://mmoreram.com/blog/2016/02/09/you-probably-need-bundle-dependencies/

PHP.net:
PHP 5.6.18 & 5.5.32 Released
Feb 05, 2016 @ 09:49:31

On the main PHP.net site they've officially announced the release of the latest versions in the 5.6.x and 5.5.x series: PHP 5.6.18 and PHP 5.5.32.

The PHP development team announces the immediate availability of PHP [5.5.32 and 5.6.18]. This is a security release. Several security bugs were fixed in this release. All PHP [5.5 and 5.6] users are encouraged to upgrade to this version.

As always you can download this latest release from either the main downloads page or from windows.php.net for the Windows binaries. If you'd like to see exactly what was fixed in these releases, check out the full Changelog.

tagged: language version security bugfix upgrade

Link: http://php.net/archive/2016.php#id2016-02-04-3

TutsPlus.com:
Fortifying Security in WordPress, Part 1
Jan 25, 2016 @ 11:19:15

The TutsPlus.com site has posted the first part of a series wanting to help you secure your WordPress installation even more effectively. In part one of the series they cover some of the basics of securing the installation itself and the environment it lives in.

Do you think WordPress is secure? It's OK if you don't, because many people think WordPress is an insecure content management system, yet it's very far from the truth... at least today. [...] I'm sorry if you think the other way, but it doesn't. Frequent patches don't necessarily mean that a piece of software is poorly coded against security threats.

[...] The important thing here is to be responsive and preemptive, and that's something that WordPress excels at. [...] Yet, nothing is a hundred percent secure. We're living in times in which scientists are about to crack the code in our brains! Nothing is impenetrable, including our brains apparently, and WordPress is no exception. But the impossibility of 100% security doesn't mean we shouldn't go for 99.999%.

The remainder of the post is broken down into two different tips with the code/configuration changes and descriptions for what you need to update:

  • Securing the .htaccess File
  • Security Tricks for the wp-config.php File and Its Contents

The second item on that list also gets into some of the constant definitions and some advice on generating good "salt keys" for the configuration.

tagged: tutorial wordpress security series part1 htaccess configuration

Link: http://code.tutsplus.com/tutorials/fortifying-security-in-wordpress-part-1--cms-25403