Description

This detector identifies PHP code that explicitly uses Electronic Codebook (ECB) encryption mode with OpenSSL cipher functions. ECB mode is cryptographically weak as it encrypts identical plaintext blocks to identical ciphertext blocks, revealing data patterns and making it vulnerable to pattern analysis attacks.

Detection Strategy

• Reports OpenSSL cipher function calls where the cipher method parameter explicitly specifies ECB mode

• Triggers when a PHP OpenSSL encryption function (like openssl_encrypt) is called with a cipher algorithm string containing 'ECB' mode specification

• Only reports cases where ECB mode is explicitly defined in the cipher parameter, not when it might be used as a default

Vulnerable code example

<?php

class CryptoService
{
    public function encryptData($key, $data)
    {
        return openssl_encrypt($data, 'aes-256-ecb', $key); // ECB mode lacks randomization, vulnerable to pattern attacks
    }...

✅ Secure code example

<?php

class CryptoService
{
    public function encryptData($key, $data)
    {
        return openssl_encrypt($data, 'aes-256-gcm', $key); // GCM provides authenticated encryption
    }...