Phpfog "Down for maintenance"
phpfogsucks.com
Phpfog "Down for maintenance"
1–10 of 125 posts
Re: Phpfog "Down for maintenance"
#2It didn't take long for someone to use that vulnerability to open up the entire server. People are posting from the @phpfog Twitter account and someone posted the entire codebase: http://twitter.com/#!/communistcake/status/49340298677075968
Edit: Actually, the links in that message appear to just be mirrors of the links at the bottom of the article.
Edit 2: Links in that last status are now dead. Wonder if the young Elliot Speck is trying to walk it back a bit.
Re: Phpfog "Down for maintenance"
#3Heroku, NodeFu and now PHPFog. All the Heroku-style clones have had security issues in the last few months. Security in this space is very, very hard work (I think NodeFu made an checkin mistake and it wasn't a 'jail/isolation breakout' scenario).
Edit- wow - they just pointed phpfog.com at phpfogsucks.com. I feel bad for the phpfog guys - they have a long weekend ahead.
Re: Phpfog "Down for maintenance"
#4This is a pretty good lesson: when you have that little niggling feeling in the back of your head about something security-related, take care of it. Otherwise, someone WILL exploit it.
Seems like they were using the load balancer as a way to obfuscate the existence of the individual EC2 instances. Also, that has gotta be really expensive to have an EC2 instance-per-customer.
Re: Phpfog "Down for maintenance"
#5the main site now has this as the homepage http://min.us/ljEyGE
Re: Phpfog "Down for maintenance"
#6This is a pretty good lesson: when you have that little niggling feeling in the back of your head about something security-related, take care of it. Otherwise, someone WILL exploit it. Seems like they were using the load balancer as a way to obfuscate the existence of the individual EC2 instances. Also, that has gotta be really expensive to have an EC2 instance-per-customer.
Depends on the type of instance they spin up, but I would definitely tend to agree with you!
Security in shared hosting is extremely hard (I used to be a sys admin for a hosting company in a prior life), especially since there is no good way to separate everyone from each other without making performance suck completely, FreeBSD jails alleviate some of it, but you start having scalability issues, PHP running in php-fpm works, but uses up a lot of resources keeping spare instances around, there are a whole bunch of other ones as well.
Individual virtual machines per user isn't such a crazy idea but it is really expensive. What I would really like to know is how Google has accomplished it, at scale, with AppEngine. How are they able to do their security separation so well that at this point I am not even aware of any security breaches.
There has to be a better way to do it, and securely, but it may require rethinking how the entire architecture fits together, PHP, a web server, and the database engine.
Re: Phpfog "Down for maintenance"
#7What a dick move. Did these idiots actually publish their names in relation to this? Coming from "security experts" this is the most unprofessional thing I've ever seen.
Re: Phpfog "Down for maintenance"
#8the main site now has this as the homepage http://min.us/ljEyGE
Their Twitter account looks like it may have been hi-jacked as well!
Re: Phpfog "Down for maintenance"
#9This is a pretty good lesson: when you have that little niggling feeling in the back of your head about something security-related, take care of it. Otherwise, someone WILL exploit it. Seems like they were using the load balancer as a way to obfuscate the existence of the individual EC2 instances. Also, that has gotta be really expensive to have an EC2 instance-per-customer.
Depends on the type of instance they spin up, but I would definitely tend to agree with you! Security in shared hosting is extremely hard (I used to be a sys admin for a hosting company in a prior life), especially since there is no good way to separate everyone from each other without making performance suck completely, FreeBSD jails alleviate some of it, but you start having scalability issues, PHP running in php-f…
Heroku has done it reasonably well too and they seem to do it only with POSIX permissions for the most part.
Re: Phpfog "Down for maintenance"
#10What a dick move. Did these idiots actually publish their names in relation to this? Coming from "security experts" this is the most unprofessional thing I've ever seen.
It's possible that the names published discovered the issues but didn't create the dickish website.