28

When I access php.net through Google search i get the following message saying

The Website Ahead Contains Malware!

See the screenshot attached below: The Website Ahead Contains Malware!

Is it same for you guys? How can I avoid this?

Does this mean the site has been hacked or attacked by malware?

3
21

This is because Google performed a regular check on the website in the past 90 days. The results were this:

Of the 1513 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-10-23, and the last time suspicious content was found on this site was on 2013-10-23.

Malicious software includes 4 trojan(s).

Malicious software is hosted on 4 domain(s), including cobbcountybankruptcylawyer.com/, stephaniemari.com/, northgadui.com/.

3 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including stephaniemari.com/, northgadui.com/, satnavreviewed.co.uk/.

This is probably because people are leaving links to these websites throughout php.net.

7
  • Do you have a source for the claim that Google labels a site as potentially harmful just because it contains links (that have to be clicked on deliberately by the user) to sites hosting malicious software? If true, that seems like incredibly stupid behaviour that isn't helpful for the user. – Mark Amery Oct 24 '13 at 10:18
  • 1
    The safe browsing diagnostic (from which the quote above came) also says "Has this site hosted malware? No, this site has not hosted malicious software over the past 90 days." So if Google explicitly states that php.net itself did not host malware, I can only conclude that the malware must have been found on linked sites. – marcvangend Oct 24 '13 at 10:39
  • This sounds like massive overkill on google's part. I hope they fix it soon because php.net is a pretty crucial part of my daily job. – Shadur Oct 24 '13 at 10:47
  • 8
    "4 page(s) resulted in malicious software being downloaded and installed without user consent." implies that it was more than just links on the pages however. – Megan Walker Oct 24 '13 at 18:44
  • 1
    @Shadur: We all rely on references, but if you can't get by without php.net for a few days then it may be time for some training ;) – Lightness Races in Orbit Oct 25 '13 at 14:05
27

There's more to this. There are reports (1100 GMT 2013-10-24) that the links have been injected to the Javascript the site uses and it is therefore hacked for the time being.

Until you hear differently, I would avoid the site. Soon - all will be well no doubt.

1
6

And if you go to the Safe Browsing diagnostics page, you can see that:

Safe Browsing diagnostics page

To underscore:

This site is not currently listed as suspicious.

They fixed it as I posted this answer.

1
  • 1
    I've fixed my post. – NobleUplift Oct 25 '13 at 19:37
5

From the perspective of php.net itself, it seems like a false positive:

http://php.net/archive/2013.php#id2013-10-24-1

On 24 Oct 2013 06:15:39 +0000 Google started saying www.php.net was hosting malware. The Google Webmaster Tools were initially quite delayed in showing the reason why and when they did it looked a lot like a false positive because we had some minified/obfuscated javascript being dynamically injected into userprefs.js. This looked suspicious to us as well, but it was actually written to do exactly that so we were quite certain it was a false positive, but we kept digging.

It turned out that by combing through the access logs for static.php.net it was periodically serving up userprefs.js with the wrong content length and then reverting back to the right size after a few minutes. This is due to an rsync cron job. So the file was being modified locally and reverted. Google's crawler caught one of these small windows where the wrong file was being served, but of course, when we looked at it manually it looked fine. So more confusion.

We are still investigating how someone caused that file to be changed, but in the meantime we have migrated www/static to new clean servers. The highest priority is obviously the source code integrity and after a quick:

git fsck --no-reflog --full --strict

on all our repos plus manually checking the md5sums of the PHP distribution files we see no evidence that the PHP code has been compromised. We have a mirror of our git repos on github.com and we will manually check git commits as well and have a full post-mortem on the intrusion when we have a clearer picture of what happened.

1
  • 3
    It looks to me like the statement is saying php.net thinks it may actually have been hacked. Notice that they're doing a security check on all of their code. – Kevin Oct 25 '13 at 0:35
4

Latest update (at the time of posting this answer)

http://php.net/archive/2013.php#id2013-10-24-2

We are continuing to work through the repercussions of the php.net malware issue described in a news post earlier today. As part of this, the php.net systems team have audited every server operated by php.net, and have found that two servers were compromised: the server which hosted the www.php.net, static.php.net and git.php.net domains, and was previously suspected based on the JavaScript malware, and the server hosting bugs.php.net. The method by which these servers were compromised is unknown at this time.

All affected services have been migrated off those servers. We have verified that our Git repository was not compromised, and it remains in read only mode as services are brought back up in full.

As it's possible that the attackers may have accessed the private key of the php.net SSL certificate, we have revoked it immediately. We are in the process of getting a new certificate, and expect to restore access to php.net sites that require SSL (including bugs.php.net and wiki.php.net) in the next few hours.

Not the answer you're looking for? Browse other questions tagged or ask your own question.