9 ms·
I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could hav
by sriramk 16y ago
I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning.
I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up phpfogsucks.com, it might have been ok. But tweeting trash from their twitter account, redirecting their root domain to phpfogsucks, etc - are all not cool at all and should have some consequences.
- BasDirks 16y agoSecurity has nothing to do with feelings. Given the amount of should-haves in their explanation this should be a welcome wake-up call to them, a free audit. Other than playing the victim card, they handled it quite well. Nothing better to sharpen your skills and higher your standards than a _good crisis_
- Apocryphon 16y agoHire the hackers. It's what the CIA would do.
- sriramk 16y agoOnly if they demonstrated great skill - which I don't think happened in this case (but I'm no security expert either)
- sliverstorm 16y agoAnd great restraint/maturity. Which didn't happen either.
- jarin 16y agoHiring the hackers is a terrible idea. If they had done it ethically, yes. But do you really want to hire someone who has already displayed highly unethical behavior, and is likely a ticking timebomb? There are plenty of smart, ethical hackers out there.
- jammur 16y agoI don't think you can draw those conclusion from the evidence presented. I would guess that quite a lot of the top white hat hackers today sharpened their skills early with some highly unethical behavior of their own. A good example of this would be how Chris Putnam got hired at Facebook. http://www.quora.com/How-did-Chris-Putnam-get-hired-at-Facebook http://www.quora.com/How-did-Chris-Putnam-get-hired-at-Faceb...
- jarin 16y agoOh wow, I just realized that Chris Putnam is the same guy who used to post on the Something Awful forums back in 2003-2004 or so. I remember him getting trolled out of there after showing any kind of ambition beyond posting on the forums. Same thing happened to the guy who started Imageshack (originally an image host for the SA forums), Eli Hodapp (who later became one of the main TouchArcade writers), and probably some others I don't remember. Well dang, good for him!
- JonnieCache 16y agoDamn. I had no idea that being run out of SA with your tail between your legs back in the day was such a predictor of success. Who'd have thought it?
- ArcticCelt 16y agoOr do like the FBI and offer them a job, when they come for the interview they get frogmarched into the police cruiser.
- devinj 16y agoValve did that, the FBI was just the tool that was used for the job. I'm struck by the similarity in some respects of the two cases. I would guess that the same people that got really upset about Valve doing that would be a bit saddened by this, too.
- jpadvo 16y agoLucas and his team are amazing. Everyone makes mistakes, and no system will be perfectly secure. So in my mind the best parts of the entire post were these: "We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system, both as regular users as well as giving them special access and seeing if they can get through." and "If you find a security flaw and report it using the Full Disclosure Policy to security@phpfog.com with notice, we will help strengthen your security reputation in a very public way and reward you generously."
- deleted 16y ago[deleted]
- burrows 16y agoHiring white hat hackers is a joke. They are the ultimate in hacks. Step 1. Open up Metasploit Step 2. Button Mash. ???? Step 3. Profit
- tptacek 16y agoI downvoted this too, but wish I hadn't. He has a point.
- stanleydrew 16y agoHe could have made his point in a more intelligent way.
- tptacek 16y agoJust, do be aware that there are a lot of people that fit the description he gave; they are particularly numerous among the people who use the words "white hat" or "hacker" (with any modifier) in their services.
- burrows 16y agoDownvotes because of phrasing? Here. So called 'white hat hackers' tend to be fraudulent script kiddies who couldn't hack their way out of a gibs0n. They often attend classes like this http://www.infosecinstitute.com/blog/ethical_hacking_computer_forensics.html http://www.infosecinstitute.com/blog/ethical_hacking_compute... and read a book or two like this http://www.google.com/products/catalog?q=hacking+exposed&um=1&ie=UTF-8&cid=9222957554053753255&sa=X&ei=p3KJTaX9OZCy0QGPhISEDg&ved=0CEIQ8wIwAw# http://www.google.com/products/catalog?q=hacking+exposed&.... Some times they'll even have a sweet certification like this https://www.eccouncil.org/certification/certified_ethical_hacker.aspx https://www.eccouncil.org/certification/certified_ethical_ha.... And at the end of the day all they're doing is getting the down low on your system with nmap and then going all turbo with metasploit. And if they are feeling up to a challenge they might even rip someone's exploit from milw0rm. 99% of them are frauds and the other 1% are sellouts.
- dolinsky 16y agoWhat I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things.
- antihero 16y agoI know, they acted as if they could get away with it by apologising. However, whatever you think of PHPFog, a lot of people have invested everything they have in that project, and it could have (and still could have) done irreperable damage to their reputation and investment. Big companies can tank this crap but attacking a new startup is like punching a child.
- deleted 16y ago[deleted]
- parfe 16y agoMaybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading that article because it used the word blowjob." I don't get angry at my dog when he shits in the house. Being angry at something that can't understand only satisfies the urge to shift blame. My dog shits in the house and it's my fault for not walking him sooner. If some children compromise every level of your company then getting mad at them is only trying to deflect the blame. PHPFog is the only responsible party in this mess. I feel for the customers who still trust them.
- eoghan 16y agoI would encourage them to pursue legal action. I think it's right, justified and also strategically important—you can't have other kids thinking they will get away with it in the future.
- darrenkopp 16y agoYup, ruin a kids life to act as a deterrent to other kids. Fortunately this strategy has been keeping our products protected and secure for years after Valve had the FBI track that kid that leaked half-life 2's source code and put him in prison. Unfortunately, this situation was much more severe than your average multi-million dollar AAA gaming title being leaked before release (http://www.ea.com/crysis-2/blog/crysis-leak http://www.ea.com/crysis-2/blog/crysis-leak ), so this requires the FBI and prosecution.
- tptacek 16y agoThis isn't a DRM break.
- Stormbringer 16y agoThe problem with pressing charges as a detterrent is that it is fundamentally unjust, because the punishment is set up as a detterrent and is disproportionate to the crime. Example: imagine the country of Dictatoria where if you jaywalk you are publicly tortured for a couple of weeks and then put to death. "As a detterrent" A little extreme? Well, consider the 10-20 (or more) year sentences for cyber-terrorism these teenagers are going to get if the FBI throws the book at them. That kind of law enforcement agency doesn't understand the concept of restraint - they are set up to go for the kill, for the maximum charge, for the maximum sentence every time. You can lay charges thinking to give them a slap on the wrist, but the steam roller that gets set in motion is designed to crush them flat with no mercy.
- lambda 16y agoWhy do you think these kids would get 10-20 year sentences? Have you ever heard of a computer crime getting that high of a sentence? No one on http://en.wikipedia.org/wiki/List_of_convicted_computer_criminals http://en.wikipedia.org/wiki/List_of_convicted_computer_crim... has gotten more than 5 years, and they include people who have sold access to botnets of hundreds of thousands of machines. A quick Google search reveals someone sentenced to 20 years, but for stealing millions of credit and debit card numbers, which is actually a sizable crime with significant damage to many victims. http://www.scmagazineus.com/hacker-albert-gonzalez-receives-20-years-in-prison/article/166571/ http://www.scmagazineus.com/hacker-albert-gonzalez-receives-...
- Stormbringer 16y agoThere is a story along these lines, it happened recently in New Zealand. Some parents had an argument with their teenage son, and he went off in a huff taking the family car (technically without asking permission). His parents thought to themselves "I know, we'll teach him a lesson", so they reported the car stolen. They intended to later on drop the charges (which would have royally peeved the police, making a false charge is also a crime). Anyway, the cops caught the kid, and because Grand Theft Auto (or whatever the NZ equivalent is) is rated as amongst the most serious crimes, he got sent off (before formal charges were laid) to a maximum security facility in the back of a paddy wagon. He didn't even make it to the maximum security facility. One of the other prisoners being transported there in the same van killed him.