You Got Ruby In My PHP! (You Got PHP In My Ruby!)
summary
A production PHP host gets rooted because a script meant for an isolated instance runs in a shared Apache failover environment, exposing shared SSH private keys and a reused Twitter password that also controls DNS and Google Apps. Infrastructure uses varnish, nginx and DB master/clone; over a thousand app servers go offline. Response is: shut everything, preserve logs, assume total compromise, rotate keys and billing IDs, force mass password resets, rebuild from scratch (about 1,200 servers rebuilt in two days via configuration management) and adopt bastion SSH and bcrypt.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:58Security breach response
- 4:00Infrastructure compromise
- 5:49Security trade-offs
- 7:11Hacker lateral movement
- 8:36Containing breach
- 9:39Disclosing breach
- 10:43Password security risks
- 12:28Rebuilding after compromise
- 14:56Rebuilding securely
- 16:43Security audits
- 17:48Regaining trust
- 19:12Schneier's security lessons
- 22:20Q&A
