How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again) • Hacker News Board

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#191

Post by colanderman » Wed, Mar 23, 2011, 6:58 PM UTC

lambda wrote: post #113

parfe wrote: post #81

Earlier quoted context omitted.

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

This isn't a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowledge and skills to exploit the system. And once the exploit worked, they didn't then responsibly disclose the problem to PHPFog; they started vandalizing, changing passwords, and the works. This is like someone finding an unlocked door to the apartment buildin…

I work with 16 year olds on a daily basis. Many, if not most, of them have a severely underdeveloped sense of morality, and know "right" from "wrong" no more than adults dictate to them.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#192

Post by lyonheart » Wed, Mar 23, 2011, 7:03 PM UTC

jarin wrote: post #45

16s wrote: post #36

Earlier quoted context omitted.

Let's hope they are salted and iterated.

Or swapped over to Bcrypt

we've cleared the old SHA512-salted passwords out of our production database and have upgraded the password hashing to bcrypt, with a cost of 10.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#193

Post by jarin » Wed, Mar 23, 2011, 8:29 PM UTC

lyonheart wrote: post #192

jarin wrote: post #45

Earlier quoted context omitted.

Or swapped over to Bcrypt

we've cleared the old SHA512-salted passwords out of our production database and have upgraded the password hashing to bcrypt, with a cost of 10.

Good call :)

Just in case anyone doesn't know why Bcrypt is so awesome, it's because it actually takes longer to hash (based on the difficulty level you set, and you can bump up the difficulty level as hardware gets more powerful).

For other applications, you want hashing to be fast. But for passwords, you want hashing to be as slow as possible without compromising user experience.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#194

Post by jarin » Wed, Mar 23, 2011, 8:32 PM UTC

dolinsky wrote: post #57

sriramk wrote: post #4

I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning. I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up…

What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…

I don't know if you were ever a teenager, but I remember when I was a teenager I had a willful disregard for consequences or how my mischief affected others.

I think they should definitely get something a little stronger than a slap on the wrist, but also remember that they're just teenagers who don't know any better. All they really need is enough of a punishment to learn their lesson, and they'll probably end up productive members of society.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#195

Post by tjarratt » Wed, Mar 23, 2011, 10:56 PM UTC

mtogo wrote: post #61

tjarratt wrote: post #19

The phpfog guys really deserve praise for being so open on this issue. As a fellow engineer, being able to learn from their mistakes and see exactly what they could have done ahead of time to avoid the disaster is priceless. Just goes to show that those with the time to spend are the most likely to break your stuff, even if you pay "professional white hat hackers" to test your system.

On the contrary, they knew of security vulnerabilities and intentionally left them unpatched, then blamed it on chance and timing when they got owned because of it. Avoid phpfog if at all possible, in my opinion.

If I lost $1 for each time I left a known vulnerability unpatched because I was convinced I had more important work to do, I would be a very poor man indeed.

Honestly, there are very very few developers that fix security problems in beta environments before anything else. In my experience, it's more likely that you're fighting fires, handling outages, and dealing with problems of scale than fixing security vulnerabilities.

Besides, isn't a beta the correct time to find these security issues? (Design / Alpha would be the ideal time, granted, but sometimes that's not possible.)

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#196

Post by lyonheart » Wed, Mar 23, 2011, 11:04 PM UTC

jarin wrote: post #193

lyonheart wrote: post #192

Earlier quoted context omitted.

we've cleared the old SHA512-salted passwords out of our production database and have upgraded the password hashing to bcrypt, with a cost of 10.

Good call :) Just in case anyone doesn't know why Bcrypt is so awesome, it's because it actually takes longer to hash (based on the difficulty level you set, and you can bump up the difficulty level as hardware gets more powerful). For other applications, you want hashing to be fast. But for passwords, you want hashing to be as slow as possible without compromising user experience.

I wanted Lucas to link to Coda Hale's post on bcrypt (found by googling "Coda Hale bcrypt") in the blog post, but he edited that out. So it goes.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#197

Post by zmmmmm » Wed, Mar 23, 2011, 11:25 PM UTC

jasonwatkinspdx wrote: post #140

zmmmmm wrote: post #34

Earlier quoted context omitted.

When I asked for a raise to my limit they denied me, on the basis that my usage was insufficient. Of course, my usage was low because I hadn't launched my product fully because I didn't have enough instances to serve a lot of customers ... catch 22. So I had to build out a rather convoluted architecture that used the loophole of deploying to multiple regions and failing over to whichever region would give me an insta…

Sorry you had a bad experience. I have gotten nothing but superb support from Amazon staff. I'm surprised they weren't willing to accommodate you, doubly so if you were ready to pay. One thing that surprises me is when people talk about utilizing multiple availability zones in EC2 as some sort of burden. It's very clear from their documentation and architecture that you need to be capable running in at least 2 availa…

> people talk about utilizing multiple availability zones in EC2 as some sort of burden

My use case isn't for an ongoing server where you require availability. It's purely about compute power - I don't care where the compute power comes from but preferably I want low latency to my customer. So ideally I would just get all instances for any given customer from a single region.

I did find in the end that, as you say, I would sometimes not be able to get an instance in a region even when I was below my 20 limit for reasons internal to Amazon, so the failover work was going to be something I had to deal with anyhow ... but it just added complexity to my life earlier than it would have otherwise.

Edit: I would also mention that I certainly don't think of it as a "bad" experience. I think it is something of a small miracle that Amazon offers the service they do in the first place and I certainly understand why they have caution about handing out large limits to just anyone. I only made my comment above as a kind of caution to not just assume you're going to get a raised limit from Amazon immediately and especially don't leave talking to Amazon about it until the last minute if you're planning to launch something.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#198

Post by mtran » Thu, Mar 24, 2011, 5:19 AM UTC

nbpoole wrote: post #37

citricsquid wrote: post #13

I mentioned this last time, but I don't think anyone was interested, but the "John" guy is compwhizii (same handle on Twitter) who runs the forums (facepunch.com) for garrysmod, a very popular game. I will be curious to see how garry (owner person) responds to this, or if he already has. Elliot is apparently VERY scared and blames John (compwhizii) (edit: not john, he blames someone else called supersnail1): http://w…

And here's Elliot's "official statement": http://elliotspeck.com/phpfog.html And for anyone who missed it, here's what Elliot posted in the previous HN discussion about the phpFog breach: http://news.ycombinator.com/item?id=2346161

Elliot's statement and a lot of his Facepunch comments have been taken down. As an educator, I found a lot of the comments there pretty alarming... and want to ask everyone here to consider a few things when posting about anything related to kids.

Kids (and like it or not, that IS what they are) are notoriously dramatic and these kids are definitely experiencing this as a crisis, no matter how they present in their comments.

They are also now being border-line, and in some cases overtly cyber bullied by some of their peers online which may be devastating if they don't have great face-to-face support. As adults, we have a responsibility not to add fuel to that fire and remember that if teenagers were predictable and transparent, there wouldn't be so many tragic cases in the news where they hurt themselves and each other.

Part of the problem is that teenagers and young adults aren't great at predicting consequences. This isn't opinion - it's science.

Especially in males, the part of the brain that is responsible for predicting consequences is not fully developed until the early to middle twenties. This is a double whammy because it leads to their bad decision making, but also to their belief that when something bad happens as a result, that it's literally the end of the world... that there is no way out.

There is no disputing that what these boys did was a big deal and that there have to be consequences. But it's also just a symptom of a bigger problem: as a society, we have failed to keep pace with the challenges that are the result of the first generation of digital natives (kids) being raised and educated by a generation of adults who are (at best) digital immigrants.

This post is getting way too long so I'm going to finish it on my blog @ thenewtag.com But thanks, criticsquid and nbpoole for posting some of the aftermath. I hope that one of the 1st things phpfog (or the authorities) did was involve these boys' parents?

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#199

Post by [deleted] » Thu, Mar 24, 2011, 5:22 AM UTC

citricsquid wrote: post #13

I mentioned this last time, but I don't think anyone was interested, but the "John" guy is compwhizii (same handle on Twitter) who runs the forums (facepunch.com) for garrysmod, a very popular game. I will be curious to see how garry (owner person) responds to this, or if he already has. Elliot is apparently VERY scared and blames John (compwhizii) (edit: not john, he blames someone else called supersnail1): http://w…

[deleted]

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#200

Post by nakkiel » Thu, Mar 24, 2011, 5:11 PM UTC

merijnv wrote: post #165

nakkiel wrote: post #94

Earlier quoted context omitted.

The last bit is priceless. The mere fact that the kid doesn't show any sort of adequate moral judgement should justify prosecution.

Isn't the lack of adequate judgement (moral or other) the definition of being a kid?

At least he could be more of a kid and pretend. Which means I actually agree with you.