Date: Sun, 19 Apr 2015 12:43:30 -0400 From: Scott Arciszewski <scott@...agonie.com> To: oss-security@...ts.openwall.com Subject: Pharaoh - PHAR Comparison Tool Hi everyone, We developed a tool to compare executable PHP Archives (.phar files), which you may find at https://github.com/paragonie/pharaoh Previously, there wasn't a tool available that specifically worked with .phar files, which differ from just a .zip or .tar in that they have an executable stub which allows you to do something like this: <?php include "vendor/acme/deliverable.phar"; $foo = \Acme\Deliverable\Foo(); $bar->process($foo); Pharaoh is useful for open source projects that distribute a .phar (phpunit, composer, etc.). Since many of these projects do not sign their .phar, if their server gets hacked it would be trivial to slip in a bit of extra code in the stub (add a public key to ~/.ssh/authorized_keys, etc). The idea is that someone can download the .phar from their website, build the same one from source, then use Pharaoh to compare them and detect this malicious tampering. (And then, hopefully, blow the whistle to disrupt the campaign.) We hope that someone finds this useful. Scott Arciszewski Chief Development Officer Paragon Initiative Enterprises <https://paragonie.com>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ