Compromised SourceForge mirror distributes backdoored phpMyAdmin package

About 400 users downloaded a backdoored phpMyAdmin installer after a SourceForge mirror in Korea was compromised

Unknown attackers compromised a download mirror server for the SourceForge software repository, rigging the installer package for phpMyAdmin, a popular Web-based MySQL database administration tool, with a backdoor.

SourceForge is a Web-based collaborative software development and repository system that hosts over 324,000 software development projects and serves 46 million users. The service is operated by Geeknet, a company based in Fairfax County, Virginia, U.S.

"One of the mirrors, namely cdnetworks-kr-1, was being used to distribute a modified archive of phpMyAdmin, which includes a backdoor," the phpMyAdmin development team said Tuesday in a security advisory. "This backdoor is located in file server_sync.php and allows an attacker to remotely execute PHP code."

The modified package was and, according to access logs from the compromised mirror server, it was downloaded by approximately 400 users.

An identifier of CVE-2012-5159 was assigned to the vulnerability introduced by the phpMyAdmin backdoor code. Security vendor Secunia rates the vulnerability as extremely critical because it provides system access and can be exploited remotely.

A module targeting the vulnerability was added to the Metasploit penetration testing framework on Tuesday.

The affected mirror server was based in Korea and was compromised on or around Sept. 22, the SourceForge team said Tuesday in a blog post. "The mirror provider has confirmed the attack vector has been identified and is limited to their mirror," the SourceForge team said.

The mirror server was removed from rotation after SourceForge learned of the compromise on Tuesday. However, the team is still investigating whether the phpMyAdmin archive was the only package modified by the attackers.

The mirror provider appears to be a company called CDNetworks that specializes in Internet content delivery. CDNetworks has been operating SourceForge mirror servers in the U.S. and Asia since 2009. A spokeswoman for CDNetworks in the U.S. said she was looking into the incident, but was not immediately able to provide more information about the apparent security breach.

It's not clear why the rogue package modification wasn't detected earlier since by definition mirror servers should mirror the content from a central repository. "Automated mirror validation occurs on an ongoing basis and SHA1/MD5 sums [file digital fingerprints] are provided for validation client-side," Rich Bowen, a SourceForge official, said Tuesday via email.

Users who downloaded and deployed the package recently are advised to check whether heir phpMyAdmin installations contain the rogue server_sync.php file. If the file is found, the software should be deleted and a fresh copy of the package should be downloaded.

Web server administrators are also advised to check the server logs in order to determine whether the backdoor was accessed and used to execute rogue code on their servers.

The phpMyAdmin development team regularly publishes the MD5 checksums for the software's official install packages on its website. For example, the legitimate archive has an MD5 checksum of "6f284e973809af8cda998eeaa9aa7884".

Users should calculate the MD5 checksum of the package they download and compare it to the one published by the phpMyAdmin developers in order to verify that it is legitimate. A modified package will have a different MD5 checksum.

In fact, users should always perform a checksum verification when downloading software for use on their computers or servers, whenever the developer provides an MD5 or other type of checksum for the installer. Some browsers, like Mozilla Firefox, have extensions that make checksum checking easier.

This is not the first time that a download server has been compromised and the installer of a popular application has been backdoored.

In June 2011, the WordPress development team warned that some fairly popular WordPress plug-ins had been backdoored through the official plug-in repository.

In July 2011, the maintainer of vsftpd (Very Secure FTP Daemon), a popular FTP server software, announced that the master vsftpd download site was compromised and the software's official packages were rigged with a backdoor.

In December 2010, unknown hackers compromised the main distribution server of the ProFTPD Project -- another popular FTP server software -- and added a root shell backdoor to the source code.

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts