Feeds

PHP apps: security's low-hanging fruit

Why PHP apps accounted for 43% of security issues in 2006

Security for virtualized datacentres

PHP has become the most popular application language on the web, but common security mistakes by developers are giving PHP a bad name. Here's how PHP coding errors have become the new low-hanging fruit for attackers, contributing to the phishing problems on the web.

PHP became one of my favorite languages because of how quickly one can write a highly functional, standards-based web application with a database back-end. Unfortunately, attackers are taking these applications down even faster than they appear.

I'm sure I'll receive my share of flames under this column - but this is unfortunate, as I would hate to see such a nice language start to languish - however, for many folks there's no easier way to compromise a web server than to find a vulnerable application written in PHP.

The great rise of PHP

Let me start by saying that I'm a big fan of PHP and have written a number of web applications with it over the years. It's a great language that is now object-oriented, powerful and easy to learn, has a simple syntax, integrated SQL connectors, and high performance. It's simple to compile, very cross-platform, and has become arguably the dominant language on the web - thousands of commercial and open-source applications are available and in use.

The developers of PHP are doing many things right, from offering excellent support, protecting intellectual property in commercial applications, maintaining both the current release (5.x) and one prior, extending the object oriented approach, working with the community, and all sorts of other things. But not everything is rosy in the PHP world.

The problem is, PHP applications accounted for about 43 per cent of the security issues in 2006, according to the National Institute of Standards and Technology (NIST). Diving deeper into this number, there's the issue of determining who's most responsible for the problem. Do we blame PHP itself for being an insecure language, or do we blame the many inexperienced programers who have created vulnerable PHP applications and released them to the world?

The fact is, the vast majority of vulnerabilities found in PHP applications are due to poor programming practices, and are one step away from the language itself. Poor programming is a security problem in any language, but with PHP in particular the coding errors often lead to common web security problems such as Cross-Site Scripting (XSS), include file injection vulnerabilities, and database injection or manipulation issues.

What strikes me is how the really basic mistakes pop up again and again.

A quick tour through the SecurityFocus vulnerability database and Bugtraq and a website like milw0rm reveals many PHP applications ripe for exploitation. Many require only very simple file inclusion exploits. And that's exactly why some people are exploiting them. It's the low-hanging fruit.

It only takes a few minutes to understand a typical web application's coding errors and then search for vulnerable installations using Google. In just a few minutes, an average attacker with little talent and even less time can compromise a typical server.

While PHP application developers are by far the most responsible, there have also been numerous vulnerabilities in the PHP language itself. These are often harder to exploit, but when found they can affect the entire base of installed PHP applications on the web. So there's really two main issues at work here.

The recent departure of Stephan Esser from the internal PHP security team should also raise some eyebrows, especially after reading the explanation he gave on his blog about leaving the very group he founded. Even as a user of PHP myself and having a passion for security, I wasn't aware of some of the ongoing internal issues. Esser's Suhosin hardening project looks like one that more people should check out.

I'm focusing on the user issues in this article, but the PHP Group can still take some of the blame. They are the ones who design and grow the language, and they've chosen to take a certain route - giving application programmers more than enough rope to hang themselves, in terms of security - just as any language does. Many developers, including some very experienced ones, have indeed hung themselves due to easily made mistakes that lead to poor security.

Anyone who's experienced a server compromise due to a PHP app they didn't write and didn't audit has probably done some soul-searching and become much more wary of all the “free” PHP apps. I really enjoy using PHP, but I'm quite cautious of most applications unless it's one that is a large and successful project with a real focus on security, a dedicated security mailing list for announcements, and so on.

There are many infrastructure tools needed to secure a typical PHP web server from an unknown developer's mistakes. While this is beyond the scope of the article, I'll just list some of them here: web server hardening, CHROOT/JAIL, PHP as a separate user, an IDS with daily updates, a web application firewall, and a file integrity monitor to help detect the inevitable server compromise.

The Windows defense?

PHP shouldn't be blamed for its popularity, so I don't want readers to get the wrong idea. Many lower level languages like C/C++ are even more popular and give developers far more rope to hang themselves than PHP. Therefore, there are other issues at play.

Secure remote control for conventional and virtual desktops

Next page: The bigger picture

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.