Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

blog.phpfog.com

Post reply on HN
Print view View original

11–20 of 202 posts

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#11

Post by sriramk »

Apocryphon wrote: post #10
sriramk wrote: post #4

I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning. I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up…

Hire the hackers. It's what the CIA would do.

Only if they demonstrated great skill - which I don't think happened in this case (but I'm no security expert either)

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#13

Post by citricsquid »

I mentioned this last time, but I don't think anyone was interested, but the "John" guy is compwhizii (same handle on Twitter) who runs the forums (facepunch.com) for garrysmod, a very popular game. I will be curious to see how garry (owner person) responds to this, or if he already has.

Elliot is apparently VERY scared and blames John (compwhizii) (edit: not john, he blames someone else called supersnail1): http://www.facepunch.com/threads/1071855-A-member-of-Facepun...

Here is (compwhizii) Johns reply: http://www.facepunch.com/threads/1071855-A-member-of-Facepun...

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#14

Post by geekfactor »

"We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system..."

I guess whenever I read this kind of statement from now on I'll be thinking of HBGary and chuckling a bit inside.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#17

Post by jacques_chester »

pdenya wrote: post #2

What a crazy story. If the timelines are accurate there was an extremely small chance of this happening. Bad luck all around. My site is still down, guess i'm in the unlucky 1%.

Murphy's extended laws:

* It will go wrong at the worst possible time.

* If there are 4 possible ways for it to go wrong and you prevent all of them, it will go wrong in a 5th way.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#18

Post by jpadvo »

sriramk wrote: post #4

I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning. I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up…

Lucas and his team are amazing. Everyone makes mistakes, and no system will be perfectly secure. So in my mind the best parts of the entire post were these:

"We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system, both as regular users as well as giving them special access and seeing if they can get through."

and

"If you find a security flaw and report it using the Full Disclosure Policy to security@phpfog.com with notice, we will help strengthen your security reputation in a very public way and reward you generously."

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#19

Post by tjarratt »

The phpfog guys really deserve praise for being so open on this issue. As a fellow engineer, being able to learn from their mistakes and see exactly what they could have done ahead of time to avoid the disaster is priceless.

Just goes to show that those with the time to spend are the most likely to break your stuff, even if you pay "professional white hat hackers" to test your system.

Post reply on HN