Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

blog.phpfog.com

Post reply on HN
Print view View original

61–70 of 202 posts

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#61

Post by mtogo »

tjarratt wrote: post #19

The phpfog guys really deserve praise for being so open on this issue. As a fellow engineer, being able to learn from their mistakes and see exactly what they could have done ahead of time to avoid the disaster is priceless. Just goes to show that those with the time to spend are the most likely to break your stuff, even if you pay "professional white hat hackers" to test your system.

On the contrary, they knew of security vulnerabilities and intentionally left them unpatched, then blamed it on chance and timing when they got owned because of it.

Avoid phpfog if at all possible, in my opinion.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#62

Post by uxp »

tjarratt wrote: post #25
Aaronontheweb wrote: post #3

Goes to show you why the DRY principle (I might be stretching that analogy here, but bear with me) is important here - if you have old stuff lying around in production that was cloned a long time ago, you might forget about it and open yourself up to unfortunate incidents like this. PHP Fog is doing great work to make the PHP ecosystem easier to work with, and I hope they didn't suffer too much from this mistake.

Still stretching the analogy, but the same could be said of their password reuse.

That's exactly what I thought of.

DRYP - Don't repeat your passwords.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#63

Post by antihero »

dolinsky wrote: post #57
sriramk wrote: post #4

I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning. I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up…

What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…

I know, they acted as if they could get away with it by apologising. However, whatever you think of PHPFog, a lot of people have invested everything they have in that project, and it could have (and still could have) done irreperable damage to their reputation and investment. Big companies can tank this crap but attacking a new startup is like punching a child.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#64

Post by nethsix »

Great to see disclosure. This can happen to anyone, and more so for startups, where labor is short, focus is on developing features. Using the phrase "Never Happen Again" is a bit strong though. Security is risk management; spend until you can accept the remaining risk while still maintaining profit and avoid being a hacker's low-hanging fruit.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#65

Post by burrows »

jpadvo wrote: post #18
sriramk wrote: post #4

I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning. I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up…

Lucas and his team are amazing. Everyone makes mistakes, and no system will be perfectly secure. So in my mind the best parts of the entire post were these: "We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system, both as regular users as well as giving them special access and seeing if they can get through." and "If you find a security flaw a…

Hiring white hat hackers is a joke. They are the ultimate in hacks.

Step 1. Open up Metasploit Step 2. Button Mash. ???? Step 3. Profit

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#66

Post by teyc »

I feel for the people at phpfog.com, but this is a bigger blow to cloud computing.

Customers who are already pretty risk averse to their data being stored in the cloud would see this as another reason not to take the risk.

The cloud computing consortium needs to work on a stable stack as well as figure out how to audit that it works properly.

In addition, it calls for security ahead of features. Given that phpfog is funded, they'll need to implement the equivalent of a bleeding edge stack and a locked down stack.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#67

Post by Legion »

hitonagashi wrote: post #27
pdenya wrote: post #2

What a crazy story. If the timelines are accurate there was an extremely small chance of this happening. Bad luck all around. My site is still down, guess i'm in the unlucky 1%.

You don't hear about the 99% of the attempts that were successfully foiled by good coding practices/security audits, so given that we are hearing about a security breach at a competent firm, the likelyhood of it being a black swan event is probably fairly high.

You also don't hear about the attempts that were successful and unbeknownst to the hacked service provider.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#68

Post by eel »

I am bothered by some of the language in this post:

- we were aware of the potential security threat behind post-deploy hooks and were about to disable them [...] but...

- we were days away from replacing this server

- They were a short-term stopgap measure we had been planning to replace

To me, it sounds like the real problem could have been stated as "We were lax on security," but almost worse than that is the lack of accountability that I sense from company. Yeah, maybe it won't happen again, but it's hard to be full of confidence to buy into a service like that.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#69

Post by CGamesPlay »

eel wrote: post #68

I am bothered by some of the language in this post: - we were aware of the potential security threat behind post-deploy hooks and were about to disable them [...] but... - we were days away from replacing this server - They were a short-term stopgap measure we had been planning to replace To me, it sounds like the real problem could have been stated as "We were lax on security," but almost worse than that is the lack…

The article starts out in that tone, but it changes to be pretty remorseful after that. For example the "why it won't happen again" part.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#70

Post by ahi »

eel wrote: post #68

I am bothered by some of the language in this post: - we were aware of the potential security threat behind post-deploy hooks and were about to disable them [...] but... - we were days away from replacing this server - They were a short-term stopgap measure we had been planning to replace To me, it sounds like the real problem could have been stated as "We were lax on security," but almost worse than that is the lack…

They seemed to be blaming it on "bad timing" as if these things were ever excusable. These are also things that you either do or don't do. Your systems are either secure or they're not. "They were going to be secure tomorrow" does no one any good. It doesn't look like any of the parties involved learned much of anything from this episode.
Post reply on HN