6:11 AM  Shubham Yadav  No comments

A COUPLE of 16-year old hackers had their wicked way exploiting a security vulnerability recently that allowed one of them to steal and publish a PHP cloud hosting firm's proprietary source code on Twitter.

On his company's blog, PHP Fog founder and CEO Lucas Carlson described how an Australian called 'Eliot' and an American called 'John' embarked on a competition to see who could deface Carlson's website the fastest.

Carlson said that 'John' gave instructions to 'Eliot' to break into PHP Fog's shared hosting environment. The PHP Fog boss admitted he made it easy when he "unfortunately and stupidly" had an old copy of the company's code on the server that had PHP Fog's system passwords on it, which it had not deleted or changed. Oops.

'Eliot' posted the old codebase, PHP Fog's intellectual property, on Twitter. That must have been a lot of 140 character messages!

Carlson's blog post goes on to say that he shut down PHP Fog because of this malarky, booted 'Eliot' off the system and then rebooted the servers. Apparently annoyed, the hacker then proceeded to log into PHP Fog's Twitter account, blog and DNS manager, pointing phpfog.com to a website called "PHPFog sucks".

Later on, 'Eliot' allegedly tried to apologise in an Instant Message, saying, "I don't want any hard feelings between us, this originally started as a proof of concept to prove your platform was insecure. I guess I did that, but there are better ways I could have gone about it."

Posted in: Hacking News