oss-security - Pharaoh - PHAR Comparison Tool

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAKws9z0BcFuXDWcbnonSG=R8=KoDoS8TPDb-bPhimLM0Vox3xA@mail.gmail.com>
Date: Sun, 19 Apr 2015 12:43:30 -0400
From: Scott Arciszewski <scott@...agonie.com>
To: oss-security@...ts.openwall.com
Subject: Pharaoh - PHAR Comparison Tool

Hi everyone,

We developed a tool to compare executable PHP Archives (.phar files), which
you may find at https://github.com/paragonie/pharaoh

Previously, there wasn't a tool available that specifically worked with
.phar files, which differ from just a .zip or .tar in that they have an
executable stub which allows you to do something like this:

    <?php
    include "vendor/acme/deliverable.phar";
    $foo = \Acme\Deliverable\Foo();
    $bar->process($foo);

Pharaoh is useful for open source projects that distribute a .phar
(phpunit, composer, etc.). Since many of these projects do not sign their
.phar, if their server gets hacked it would be trivial to slip in a bit of
extra code in the stub (add a public key to ~/.ssh/authorized_keys, etc).

The idea is that someone can download the .phar from their website, build
the same one from source, then use Pharaoh to compare them and detect this
malicious tampering. (And then, hopefully, blow the whistle to disrupt the
campaign.)

We hope that someone finds this useful.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.