Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

This is not a concern that I personally have,no! In my job environment I've heard from programmers and non programmers that PHP developers always put secret backdoors in PHP that no one has access to but themselves, so if a project goes live and become a big project they can do whatever they want with it, like stealing company assets and etc.
Although I do respect to all the PHP developers in php.net and others, I'd just like to know about your opinions.

P.S: Like some viruses including Starex that were enabled by a specific action.

share|improve this question
If you say PHP developers, do you mean people who code in PHP or do you mean the developers who developed PHP itself? – Christian May 18 '12 at 11:18
People who developed core PHP. – Sheriff May 18 '12 at 11:20

4 Answers

up vote 9 down vote accepted

Backdoor are uncovered on a fairly regular basis. This is by no means something unique to PHP, and can happen for a verity of reasons. Open source projects are not totally immune as code can be quite underhanded, however this is not something that just affects open source projects

For example, Horde (php) was hacked and the attacker introduced a backdoor, but the same thing happened to VSFTP (C/C++). Sometimes the software vendor will intentionally place a backdoor in their own code. This is believed to have happened to RuggedCom's SCADA Systems, which is closed source.

Worms can contain a backdoor. For example MyDoom was an email worm that spread and opened a port which allowed code execution. Later a worm called DoomJuice spread using MyDoom's backdoor. Also verities of the PhatBot/AgoBot family of IRC bots spread piggy backing on MyDoom's backdoor allowing any teenager with a C++ compiler to take advantage of it.

It is easy to carelessly leave out a sanitation routine, who's to say its a backdoor?

share|improve this answer
How can we recognize backdoors in PHP that we download from php.net? Is there a software for it? – Sheriff May 18 '12 at 4:07
@Sheriff: As in, are you concerned that the binaries or source you're downloading may be tampered with or modified in some way? If that's what you mean, just compare the checksums. PHP has MD5 checksums on their download page you can verify against. – Matt May 18 '12 at 4:36
2  
@Sheriff I'm aware of programs written in PHP having had back doors written into them (and many other languages per Rook's excellent answer: +1!), but I've never heard of the language itself having a planted backdoor vuln. If this were happening and credibly discovered, I bet you'd hear about it in print media and then some. It'd be a watershed security event that professionals would be talking about for years and probably make textbook fodder. – Jeff Ferland♦ May 18 '12 at 4:57
1  
@Matt well waht if there was a backdoor in htmlspecialchars() that if you send the command: "!EXECUTE!rm -rf /" it would run it on the commandline. – Rook May 18 '12 at 12:41
1  
@Matt they we have completely different definitions for the word "backdoor", I'm talking about a remote shell, as often $_REQUEST variables are passed to htmlspeicalchars() – Rook May 18 '12 at 12:58
show 5 more comments
up vote 4 down vote

PHP is considered an insecure language to develop in not because of secret backdoors put in by the PHP language developers, but because it was initially developed without security as a major concern and compared to other languages/web frameworks its difficult to develop securely in it.

E.g., if you develop a LAMP/LAPP (linux+apache+mysql/postgresql+PHP) web app, you have to manually code in input/output sanitation to prevent SQL injection/XSS/CSRF, make sure there are no subtle calls to eval user-supplied code (like in preg_replace with a '/e' ending the regexp argument), safely deal with file uploads, make sure user passwords are securely hashed (not plaintext), authentication cookies are unguessable, secure (https) and http-only, etc.

Most modern web-frameworks simplify many of these issues by doing most of these things in a secure fashion (or initially doing them insecurely and then getting secure updates).

The risk of there being a secret backdoor in an open-source PHP is small; and the risk is present in every piece of software (windows/linux/apache/nginx/IIS/postgresql/oracle) you use -- both open-source and closed-source. The open-source ones at least have the benefit that many independent eyes look at it all the time and you could examine it if you wanted.

Also note in principle, even after fully examining the source code and finding no backdoors and fully examining the source code of your compiler (finding no backdoors), if you then recompile your compiler (bootstrap by using some untrusted existing compiler) and then compile the safe source code with your newly compiled "safe" compiler, your executable code could still have backdoors brought in from using the untrusted existing compiler to compile the new compiler. See Ken Thompson's Reflections on Trusting Trust. (The way this is defended against in practice is by using many independent and obscure compilers from multiple sources to compile any new compiler and then compare the output).

share|improve this answer
+1 I've read it thoroughly. it really opened my eyes. – Sheriff May 18 '12 at 15:33
up vote 1 down vote

As PHP developer I know that putting backdoors is very simply if developer want it or it's often implemented unintentionally if developer no cares about safeness and recall it exists later.

share|improve this answer
Are you working in PHP.NET? If your answer is negative then I should say read the whole question and comments carefully. – Sheriff May 18 '12 at 14:12
up vote 1 down vote

Something like this could be possible, but it would be discovered in an open source projects over the time. PHP is open source and you can use the benefits. If you are afraid in backdoors, download the source, read it and compile it yourself. Also, I suggest to use the packages from your distribution. The maintainer of the php package would find such a backdoor in upstream. If you don't trust your maintainer, download the source and read it before you compile it yourself.

Please ask these persons about the location of the backdoor. If they are so sure that php is backdoored, there shouldn't be a problem to show you the lines of code.

share|improve this answer
Are sure about this part : If you are afraid in backdoors, download the source, read it and compile it yourself. There was a backdoor in linux kernel in 2003 just by three lines of code and interestingly it was looking like a typographical mistake. Who on earth would look at the whole code in PHP!!! – Sheriff May 18 '12 at 14:10
Well.. What do you suggest? a) Trust it (blindly) b) Audit it c) Don't use it. You don't have any other options. – sfx May 18 '12 at 14:54
1  
+1 good examples, thanks – Sheriff May 18 '12 at 16:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.