21–30 of 125 posts
What a dick move. Did these idiots actually publish their names in relation to this? Coming from "security experts" this is the most unprofessional thing I've ever seen.
What a dick move. Did these idiots actually publish their names in relation to this? Coming from "security experts" this is the most unprofessional thing I've ever seen.
A mirror of the code dump (referred to in a tweet linked in this discussion) is hosted on a 16 webdev from Australia... Atleast they were kind enough to remove all API keys and passwords from the code dump.
It didn't take long for someone to use that vulnerability to open up the entire server. People are posting from the @phpfog Twitter account and someone posted the entire codebase: http://twitter.com/#!/communistcake/status/49340298677075968 Edit: Actually, the links in that message appear to just be mirrors of the links at the bottom of the article. Edit 2: Links in that last status are now dead. Wonder if the young…
Looks like their Twitter account is getting cleaned up, so they're at least aware of it now.
This is a pretty good lesson: when you have that little niggling feeling in the back of your head about something security-related, take care of it. Otherwise, someone WILL exploit it. Seems like they were using the load balancer as a way to obfuscate the existence of the individual EC2 instances. Also, that has gotta be really expensive to have an EC2 instance-per-customer.
Just for the record - the cheapest EC2 instance type is t1.micro, and amounts to ~15 USD/month (+EBS and IP costs). I didn't see their business plan so I can't tell what is their big picture about that :-)
What a dick move. Did these idiots actually publish their names in relation to this? Coming from "security experts" this is the most unprofessional thing I've ever seen.
"feel free to harass the staff in their support forums..."
The founder and CEO of PHP Fog is extremely active in their support forum. He provides lightning fast responses, and is really proactive at trying to help.
I mentioned that my app was undergoing a traffic spike, and he personally on his own initiative ran some tests to help me understand how to deal with the load.
I really feel for Lucas and the team at PHP Fog. They are awesome people, so they'll get through this. But dang, it's gotta be miserable.
This is a pretty good lesson: when you have that little niggling feeling in the back of your head about something security-related, take care of it. Otherwise, someone WILL exploit it. Seems like they were using the load balancer as a way to obfuscate the existence of the individual EC2 instances. Also, that has gotta be really expensive to have an EC2 instance-per-customer.
I don't think they are obfuscating it. If I remember correctly, their pricing page made perfectly clear that they used dedicated EC2 instances. Just for the record - the cheapest EC2 instance type is t1.micro, and amounts to ~15 USD/month (+EBS and IP costs). I didn't see their business plan so I can't tell what is their big picture about that :-)