During the past week, two critical flaws in PHP, a programming language used by millions of websites around the world, put security teams to work around the clock. Because that technology also underpins numerous government sites, computer incident response teams, known as CERTs, began distributing alerts. AND in Argentinaalmost half of the potentially affected agencies responded to the national CERT.
The former coordinator of the entity, Ariel Cessario, explained to Clarion what argentina.gob.ar and the Ministries of Health and Economy, among others, applied the measures recommended to them, based on an exchange that included update emails, meetings and contacts with agencies in the United States, Europe and Chile.
“PHP is a programming language that is used to create the websites we browse every day. Although it may be completely unknown to most non-technical citizens, it was created three decades ago and its use is so extensive and massive that it supports approximately 70% of the world’s web pages,” he explains to this medium. Cristian Borghellocybersecurity specialist and author of the Segu-info site, with extensive experience in system maintenance and security updates.
This language works on the servers that power the pages, where these flaws can allow an intruder to execute instructions from the Internet without needing an account or knowing a password.
“Criminals can take advantage of such errors to enter critical systems, steal personal, fiscal, administrative data and exploit these weaknesses in Critical Infrastructures such as telecommunications, transportation, electricity, water, atomic energy and a long etcetera,” he warns, in relation to the specific dangers of this problem, which was named P2P2Shell.
At the state level, in Argentina, there is a serious problem well known in the environment: a lack of a comprehensive inventory on the state’s own digital infrastructure. Added to the fact that many of the systems are legacy (old), the scenario becomes even more complex, as it is difficult to update quickly and know which software uses each dependency.
The urgency to update and protect systems against PHP2Shell also occurs in a turbulent time for national cybersecurity: On Friday the 23rd, Ariel “Wata” Waissbein presented his resignation as head of the National Cybersecurity Center and Cessario was fired on Monday night the 26thin the midst of the changes that the area is going through under the management of Adriana Baravalle, Secretary of Innovation, Science and Technology since August.
To this day, three people remained in the CERT of Argentinawhile PHP2Shell remains a national problem.
The State websites and the CERT response
Argentina.gob.ar is the portal that brings together the institutional pages of national organizations, with information about their authorities, services and procedures, and is built on Drupala content publishing platform powered by PHP. There may be, for example, the presentation of ARCAwhile the system to enter and carry out tax procedures works separately.
There are also differentiated services, such as My Argentina, Remote Procedures and GDEwhich may use other servers and technologies, so protecting the gob.ar site is not equivalent to covering the entire digital infrastructure of the State (in fact, part of those services mentioned does not run in PHPso they would not be vulnerable to P2P2Shell).
When those responsible for PHP published their warning on Tuesday the 20th, the Argentine CERT had already begun to notify its contacts. The information had arrived on Monday night through personal ties that Cessario had built with other security teams and that allowed them to anticipate the public announcement.
“On Monday night we automatically distributed it to our entire community, which is the entire national public sector,” he recalls. By then there was still no public update to install, so the first recommendations pointed to the mitigation: reduce the chances of an attacker exploiting the flaw while a fix was being prepared (unplug systems, in Creole).
“Updating the underlying software requires compatibility testing, maintenance windows, and service restarts, which often delays the effective application of patches,” explains Aamir Lakhani, global security strategist and researcher at Fortinet, a highly contracted cybersecurity services provider in Argentina. That means testing that apps continue to work with the update and setting aside a time slot for changes that could disrupt service.
The CERT contacted the person responsible for the argentina.gob.ar site to review which versions they were using and what recommendations and corrections they could apply. “Until Thursday, everything we suggested they did almost automatically,” he says.
In that sequence, argentina.gob.ar, Health and Economy, among the most representative (and frequently attacked) ministries, combined the available corrections with other measures to reduce the risk and, according to Cessario, “they applied all the measures that were recommended by the CERT.”
The speed of contact with these organizations has a previous history of incidents and shared work. “They are the ones who work the hardest because they are the ones most attacked. So we always had a very close and very dynamic relationship in that. Our communication channels with them were always extremely fast,” he points out.
His confirmation refers to the work that he coordinated with those teams until Thursday the 22nd. Regarding the other organizations, he maintains a reservation: “It is a great unknown, but I know that many did do it. The thing is that I cannot confirm them,” he assures.
Old systems and lack of personnel on State websites
Part of this uncertainty is explained by how the public infrastructure. The ending gob.ar brings together national, provincial and municipal sites which may have different technologies, servers and managers, while argentina.gob.ar is a specific portal that concentrates information from national organizations, authorities, services and procedures. Borghello’s site, Segu-Info, identified more than 35 thousand potentially affected gob.ar sites (see).
The lack of a comprehensive registry also makes it difficult to reconstruct what was protected after an emergency: “They have no visibility of what is belowthe important part of CERT’s work was precisely to inventory assets.” “You cannot protect what you do not know” is a cybersecurity maxim.
The survey published by Borghello in Segu-info offers a partial photograph of that universe. At the cutoff on October 29 at 1:53 p.m., it had analyzed 13,977 sites out of an inventory of 35,847 and found PHP signals at 4,758, 34% of those analyzed. In 2,354 cases he was able to confirm its use through explicit evidence; in another 2,404 he deduced it from the applications detected, a magnitude that Cessario, consulted by Clarionconsidered reasonable. The figure indicates the use of that technology and should be read with that scope: it does not identify how many sites are vulnerable or how many suffered an attack.
Among some 2,350 sites that allowed a version to be identified, 47% corresponded to PHP 4, 5 or 7, families that are no longer officially maintained, and another 9% used PHP 8.0 or 8.1, also out of support. As the observation was made from outside, the results require verification with those responsible for each system.
Cessario said that in the national public sector, versions 7 and 8and that the jump between the two can be complicated when an old application depends on functions that changed in new versions of the language. In those cases, a Migration may force the program to be adapted and test it before putting it into operation, a job that requires personnel, budget and knowledge of how it was built.
“Going from seven to eight is no longer trivial. You can’t grab and do it with two handles because you have to do a complete test of what the base of that code is so that you can migrate it to eight, know what are the things that break, how the logic is going to change,” explains Cessario.
Borghello includes among the reasons for supporting older versions “the complexity and size of the systems and data storedthe national geographic distribution or the obsolescence of other related technologies (such as servers).” To these technical difficulties he adds “negligence and lack of political decision”, along with the lack of budget, personnel and cybersecurity knowledge, according to his criticism of the State systems.
During the response to PHP, CERT had four members, according to Cessario, so coordination with the teams of each agency was essential. “We cannot go to agencies to help because we do not have the capacity. There were only four of us. Now there are three boys on top“, he explains (for his dismissal), and describes “two levels of reaction”: he questions part of the management and highlights that “those who worked were the technicians”, although he clarifies that some undersecretaries and national directors did work.
Thus, the departures of Cessario and Waissbein occurred after a particularly critical week, in which the emergence of PHP shocked the online world because it was a technology unknown to many, but very present on many official sites. “What a bad time to remove the head of CERT for a political move,” said a source close to the technical and political environment.
“There are three or four years of many more attacks due to artificial intelligence,” warns Cessario, who sees a threat in the AI models that could appear before the end of the year: “In these two months between now and the end of the year, if some of the AI models that are being proposed come out, we are going to have a serious cybersecurity problem at the national level,” he warned.
Meanwhile, it is unknown how much security is covered on Argentina’s official sites and how much of it is exposed to future (or, rather, current) cyberattacks.