1

A pretty critical issue came up, which is more legal than technical, but I hope to find a lower cost technical solution. There are laws in some countries (I'll leave out name) where you have to keep data on a server in that country. It is impossible to completely separate the back end software from the database. The government of this country can access the server and all the data on it at will and pass it to state-owned or sponsored competitor.

I am not concerned about the user data because it is kept separately from users from other countries, but I am very worried about the PHP code that is wide open on the server.

Is there a way I can compile or obfuscate the PHP code somehow so that it can still run on the server but cannot be viewed/edited/modified like compiled software?

Or is the only technical option to switch to a compiled programming language like Java?

EDIT: Please don't delete my post. I know it's not very worthy, but the answer below by Jörg W Mittag is invaluable! Perhaps someone with better knowledge of programming can edit my question to better fit the answer? Thank you :)

  • You can look into ionCube. – Andy Apr 10 '18 at 8:06
  • 2
    Why does the application server have to also be the database server? Couldn't the application server sit outside the country and connect to the database server which resides inside the country? – mcottle Jun 7 '18 at 0:38
10

Is there a way I can compile or obfuscate the PHP code somehow so that it can still run on the server but cannot be viewed/edited/modified like compiled software?

No.

In order for the code to run on the server, the CPU has to understand it. CPUs are much, much stupider than humans. If the CPU can understand it, then a human can, too. If you make it so a human cannot understand the code, then a CPU cannot either, and you can no longer run it.

By the way: all currently existing PHP implementations (Zend Engine, HVVM, P8, Quercus, Phalanger, Peachpie, HippyVM, Tagua VM, JPHP, …) will actually compile your PHP code.

Or is the only technical option to switch to a compiled programming language like Java?

No.

It makes no difference. The code has to be on the server in a form that the server can understand it. But then, a human can understand it, too.

The only possible solution to make sure that someone cannot get access to your code is … to not give them access to your code. It really is that simple.

The easiest way to achieve this, is to keep the code on your premises and only offer access to it via a tightly controlled service. That's how Google keeps its code secret, for example.

A much, much, much harder and more expensive way is to have full end-to-end encryption of your code. Essentially, you deliver the server as a tamper-proof, impenetrable black box that only allows access through a tightly controlled service. The trick here is to ensure that the black box actually stays "black". This requires that you have full control over the Operating System, all libraries, the CPU, the motherboard, the RAM, all busses and I/O chips in the system, and so on.

Remember the XBox? Microsoft transmitted the master encryption key from the encryption module to the CPU via an un-encrypted bus. They thought this would be okay because there doesn't exist any hardware can snoop such a highspeed bus. Well, it turns out if you have 10000000$ oscilloscope and a lot of time on your hand, you can actually snoop that bus, and as it so happens, MIT has invented such an oscilloscope, MIT students have a lot of time on their hands, and are trained in cryptanalysis, and they like running Linux on everything, so they created a Linux installer for the XBox, which in turn was reverse-engineered by crackers to create installers for pirated games.

By the way: there is no such thing as a "compiled programming language". Compilation or interpretation are traits of the compiler or interpreter (duh!), not the language. They live on completely different levels of abstraction. If English were a typed language, the term "compiled programming language" would be a type error. Every language can be implemented with a compiler and every language can be implemented with an interpreter. For example, all currently existing mainstream PHP, JavaScript, Python, and Ruby implementations have compilers. Conversely, there are interpreters for C, C++ and Haskell.

  • 1
    Just a note. Compiling code can be (at least in certain languages) de-compiled too. That's a fairly and common practice in Java (overall when you inherit a project which source code doesn't match the version running in production and you still have to manage to maintain it somehow). So, compiling code might not be the best choice for hiding code. – Laiv Apr 10 '18 at 8:19
  • I never understood why people even think that compilation "hides their code". The definition of "compilation" is literally "translation from one language to another". So, it should be immediately obvious that compilation doesn't "hide code". The exact same code is still there, it's just in a different language. Nothing is being hidden. Information on how the program was originally written may be lost, but all the information about what the program does, must still be there, otherwise it would no longer be runnable! – Jörg W Mittag Apr 10 '18 at 10:25
  • The common assumption is that code is converted to machine readable code in contrast with human readable code. The assumption is: human readable is code source, machine readable is executable. Since my editor doesn't show well the executable, the code has been obfuscated. Just a false premise :-) – Laiv Apr 10 '18 at 10:50
  • You can actually obfuscate code, the problem is that then your government can de-obfuscate it. – immibis Apr 11 '18 at 5:15
5

You can obfuscate but you cannot hide completely. I've been forced to use both ionCube and Zend Guard before, which perform this obfuscation, and there is no big difference between them. These products precompile your PHP files to bytecode (opcode) and ship only the bytecode in an encrypted container. At runtime a loader (which you must enable on the server) decrypts the bytecode and inserts it into memory.

When you use such tools casual snooping is blocked, but a determined attacker can still figure out what your code does. Modification also becomes harder because the source code is not included (only the bytecode). Decompiling the bytecode back into (some form of) source code is however possible and there seem to be some commercial tools online which do this, but I have no experience with them.

  • 1
    "When you use such tools casual snooping is blocked, but a determined attacker can still figure out what your code does." – And the OP's assumed attacker is a hostile government, which in security are usually assumed to have unlimited resources and determination. – Jörg W Mittag Apr 10 '18 at 10:27

protected by gnat Aug 14 '18 at 5:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.