Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]

[Christine Kronberg <Christine_Kronberg () genua de>]

On Mon, 20 Feb 2006, Gadi Evron wrote:
> Christine Kronberg wrote:
> > On Sun, 19 Feb 2006, Gadi Evron wrote:
> >
> > > Today, we received a notification about a new Linux malware ItW (In the 
> > > Wild).
> >
> >   They are not exactly new. I've seen them floating around for about
> >   two months now. There a different binaries running around doing the
> >   same work (different the way that they have been compiled on different
> >   linux distributions). Part of that work is to be distributed by trying
> >   to get in via vulnerable php scripts. Look to me like being part of a
> >   worm.
>
> Indeed, the most annoying thing about the PHP worms today is that these PHP 
> vulnerabilities being exploited are everywhere.
>
> As I already mentioned, this recent Linux worm has more to it, but that's in 
> another post.

  I know. The first time I got that "double" was on 15.12.2004.
  Actually there four components to most of the attacks. There are
  the two programs you are talking about. And there are two scripts
  acting as helpers to download the stuff.

> These vulnerabilities being exploited are very difficult to protect from 
> because:
> 1. PHP is the "serious" or at least open-source/Linux/security freak's choice 
> for web development. Mine as well (although as many still say, Perl does a 
> better job).

  As I'm not familiar with php I'm not sure if php is the problem.
  To me it seems more likely that problem lies in the way people
  "program" their webapplications.

> 2. Developing secure applications in PHP is difficult, as one of PHP's 
> creators said recently - even to him after years of trying.
>
> 3. Staying on top of new PHP vulnerabilities has become impossible, popping 
> around everywhere.

  I do not see so much php vulnerabilities but vulnerabilities in
  application written in php - written by people not thinking about
  input validation, not thinking about buffer overflows.

> One note I'd like to make, is that even if the second (interesting) payload 
> in the Linux worm wasn't there, just because someone utilizes old malware in 
> the creation of new malware doesn't mean it is new, or 99.9% of any "virus" 
> every written would be old.

  See above. The second part was in there since at least 15th of December
  last year.

  Cheers,


                                                     Christine Kronberg.

--
GeNUA mbH