Is this at all incriminating against php itself? Tumblr which is written in php had a security issue and now php fog. Is php hard to secure as opposed to other languages/platforms?
Did you RTFA? This had nothing to do with php.
Phpfog "Down for maintenance"
41–50 of 125 posts
Re: Phpfog "Down for maintenance"
#42Even at 16, you should be mature enough to know that this is classless. I hope for their sake they never start their own business and never fuck up, because that'd be awfully sad if the next kids to come along decided to show them the same courtesy they've shown here.
This is just precious: @ElliotSpeck: > ...I'm available for consulting if you ever want to hire a security manager for @phpfog. :) As someone who takes security seriously, and manages shared hosting security for a living, I can't imagine what the PHPFog people are going through right now. Finding security holes in commercial systems and discreetly notifying the owners of the problem is one thing; broadcasting knowled…
> Finding security holes in commercial systems and discreetly notifying the owners of the problem is one thing
Last time this happened to me, I gave 6 months free on a dedicated server which was announced in an e-mail that went out to around a thousand users (the focus was explaining why feature x was disabled for the past few days).
It was brought up in discussion that it was probably too much, but the alternative to me was terrifying considering the amount of tickets opened because of the preventative measures.
Re: Phpfog "Down for maintenance"
#43This is a pretty good lesson: when you have that little niggling feeling in the back of your head about something security-related, take care of it. Otherwise, someone WILL exploit it. Seems like they were using the load balancer as a way to obfuscate the existence of the individual EC2 instances. Also, that has gotta be really expensive to have an EC2 instance-per-customer.
I don't think they are obfuscating it. If I remember correctly, their pricing page made perfectly clear that they used dedicated EC2 instances. Just for the record - the cheapest EC2 instance type is t1.micro, and amounts to ~15 USD/month (+EBS and IP costs). I didn't see their business plan so I can't tell what is their big picture about that :-)
If they use reserved instances, it should be even less than that. They still need to control abuse in terms of bandwidth, etc. and that is the difficult part.
Re: Phpfog "Down for maintenance"
#44Earlier quoted context omitted.
Depends on the type of instance they spin up, but I would definitely tend to agree with you! Security in shared hosting is extremely hard (I used to be a sys admin for a hosting company in a prior life), especially since there is no good way to separate everyone from each other without making performance suck completely, FreeBSD jails alleviate some of it, but you start having scalability issues, PHP running in php-f…
Heroku has done it reasonably well too and they seem to do it only with POSIX permissions for the most part.
Ahem. There have been multiple exploits for heroku, some of which enabled access to code and data of other heroku customers (google for "heroku vulnerability").
From what I read about their virtualization (which may not be up-to-date) they seem to rely on the security of chroot(). If that is still the case then there is a big problem in their future.
Re: Phpfog "Down for maintenance"
#45It didn't take long for someone to use that vulnerability to open up the entire server. People are posting from the @phpfog Twitter account and someone posted the entire codebase: http://twitter.com/#!/communistcake/status/49340298677075968 Edit: Actually, the links in that message appear to just be mirrors of the links at the bottom of the article. Edit 2: Links in that last status are now dead. Wonder if the young…
They put them up on Amazon S3, I am guessing they didn't want to pay for the hosting fees.
Looking at the reverse dns, the website is hosted on a someone's home server at the moment (Internode ADSL: Sydney, Australia)
I hope they're not using phpfog's AWS credentials to pay to distribute dumps of their own site.
Re: Phpfog "Down for maintenance"
#46This is a pretty good lesson: when you have that little niggling feeling in the back of your head about something security-related, take care of it. Otherwise, someone WILL exploit it. Seems like they were using the load balancer as a way to obfuscate the existence of the individual EC2 instances. Also, that has gotta be really expensive to have an EC2 instance-per-customer.
Depends on the type of instance they spin up, but I would definitely tend to agree with you! Security in shared hosting is extremely hard (I used to be a sys admin for a hosting company in a prior life), especially since there is no good way to separate everyone from each other without making performance suck completely, FreeBSD jails alleviate some of it, but you start having scalability issues, PHP running in php-f…
>What I would really like to know is how Google has accomplished it, at scale, with AppEngine. How are they able to do their security separation so well that at this point I am not even aware of any security breaches.
Easy (well it takes a lot of work, but it isn't difficult): they only allow languages that run on VMs, they then rewrite the VMs to remove/limit the file system access, network access and whatever else they don't want you to access, prevent access to unknown C code (since you can always fudge with the stack and other fun stuff at that point) and count the memory used and instructions run (so they can bill you and so denial of service gets too expensive).
This kind of thing is easy to do if you throw 100 good developers on it. My guess is that phpfrog didn't have that kind of manpower.
Re: Phpfog "Down for maintenance"
#47Not the first "you've been pwned" message on the Internet and won't be the last. It just happens to be the first I've seen use Google Analytics to track the lulz with CSS and @font-face. With that layout I was expecting to see a customer rant, not a "pwned" message. On a more serious note are they going to be able to afford to have a separate EC2 instance per customer to avoid having to write a proper sandbox?
After serious reputation damage… will they still have customers?
Sure if I need a place for scalable php code, and they explained how they fixed they security issues I would be willing to go with them.
But I would properly become a fisherman before working with php...
Re: Phpfog "Down for maintenance"
#48Even at 16, you should be mature enough to know that this is classless. I hope for their sake they never start their own business and never fuck up, because that'd be awfully sad if the next kids to come along decided to show them the same courtesy they've shown here.
I'm a 17 year old developer, also from Queensland. The majority of us know what responsible disclosure is. Looks like someone missed the memo.
Re: Phpfog "Down for maintenance"
#49Is this at all incriminating against php itself? Tumblr which is written in php had a security issue and now php fog. Is php hard to secure as opposed to other languages/platforms?
Did you RTFA? This had nothing to do with php.
Did you not RTFA? The article is about a PHP hosting company that is getting merc'd because of the security flaws inherent in PHP that lead to their design decision to use Amazon EC2.
Re: Phpfog "Down for maintenance"
#50[deleted]