00:03:55 · Matthew Prince, Jordi Hays
But anyone that's running a web server today, you know, the the... You you need to be up... If it's running PHP, you need to be up... Updating that. It's it's critically important. The NSA has issued guidance that if for some reason you can't issue the patch, it's actually better to take your server offline than it is to to run it naked right now. And we we went from seeing, you know, before, you know, or... It's clear that some details of the of the vulnerability got leaked, which if you're reporting to that many people, fact that that was kept secret for as long as it [00:04:29] S1: was. Yeah. I was gonna say, that is that somewhat... Yeah. Isn't that somewhat of a miracle that this has been going on for two months and it required coordination between people and tons of different country... Countries and different organizations. Like, honestly, some... You know, restore some faith in humanity that people could keep that big of a secret that
00:04:29 · Jordi Hays, Matthew Prince
[00:04:29] S1: was. Yeah. I was gonna say, that is that somewhat... Yeah. Isn't that somewhat of a miracle that this has been going on for two months and it required coordination between people and tons of different country... Countries and different organizations. Like, honestly, some... You know, restore some faith in humanity that people could keep that big of a secret that [00:04:49] S2: And it was... And I I think they did. It was it was just in the last, you know, thirty six hours that we started to see an uptick where clearly something had leaked. Interesting. And and that then prompted the PHP Foundation to release the patch. The problem is the minute you release the patch, it gives enough detail that... And people can figure out how the exploit happens. So we went from hours before the patch was released, we were seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute Wow. Across our network where there... You know, people are trying to compromise servers. And again, you know, Cloudflare's protection is helping. But the real key is if you're running a server right now, get it updated with with the latest version of PHP. It's free. It should only take a few minutes to do it. Sure. If you're if you're using managed software like like WordPress, often it will do it for you automatically. But that's that's the most important thing that you can do to stay safe right now.
00:04:49 · Matthew Prince, John Coogan
[00:04:49] S2: And it was... And I I think they did. It was it was just in the last, you know, thirty six hours that we started to see an uptick where clearly something had leaked. Interesting. And and that then prompted the PHP Foundation to release the patch. The problem is the minute you release the patch, it gives enough detail that... And people can figure out how the exploit happens. So we went from hours before the patch was released, we were seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute Wow. Across our network where there... You know, people are trying to compromise servers. And again, you know, Cloudflare's protection is helping. But the real key is if you're running a server right now, get it updated with with the latest version of PHP. It's free. It should only take a few minutes to do it. Sure. If you're if you're using managed software like like WordPress, often it will do it for you automatically. But that's that's the most important thing that you can do to stay safe right now. [00:05:46] S0: What about in the in the consumer realm? Are there... I've I've been sort of... You know, I've I've run into other people who have been like, oh, I've heard about this. Do I need to update my iPhone or update my Chrome tabs? Like, is there anything that that that breaks out into the consumer world, or is all of this just for, webmasters, people who are actually serving, web services, running servers, or does anything bleed over into consumer just yet?
00:05:46 · John Coogan, Jordi Hays, Matthew Prince
[00:05:46] S0: What about in the in the consumer realm? Are there... I've I've been sort of... You know, I've I've run into other people who have been like, oh, I've heard about this. Do I need to update my iPhone or update my Chrome tabs? Like, is there anything that that that breaks out into the consumer world, or is all of this just for, webmasters, people who are actually serving, web services, running servers, or does anything bleed over into consumer just yet? [00:06:14] S1: People are saying cycle your your Social Security number. [00:06:18] S0: Oh, yeah. Rotate your Social Security number. I saw that. [00:06:21] S2: Yeah. I think... I mean, I I think that in this particular case, you know, the PHP vulnerability Yeah. Really applies to businesses and people running running web servers. So there's not as much for the consumer. But but, you know, it would... As as if TSTO and the Chainsmokers and Common and a... And one of the worst vulnerabilities the web has ever seen wasn't enough for one week. We also had other vulnerabilities that were disclosed this week. There was a Node. Js vulnerability that was also something that probably consumers have to care about. The one that consumers should care about more is that there was a... It was discovered that one of the key root servers that powers the encryption behind the Internet, they're supposed to be secured with these very long complicated passphrases. They're supposed to be three twenty eight bits at a minimum. Instead, an an Indian company that was running some of these these root root server... Root key servers
00:06:21 · Matthew Prince, John Coogan, Jordi Hays
[00:06:21] S2: Yeah. I think... I mean, I I think that in this particular case, you know, the PHP vulnerability Yeah. Really applies to businesses and people running running web servers. So there's not as much for the consumer. But but, you know, it would... As as if TSTO and the Chainsmokers and Common and a... And one of the worst vulnerabilities the web has ever seen wasn't enough for one week. We also had other vulnerabilities that were disclosed this week. There was a Node. Js vulnerability that was also something that probably consumers have to care about. The one that consumers should care about more is that there was a... It was discovered that one of the key root servers that powers the encryption behind the Internet, they're supposed to be secured with these very long complicated passphrases. They're supposed to be three twenty eight bits at a minimum. Instead, an an Indian company that was running some of these these root root server... Root key servers [00:07:16] S0: Yeah. [00:07:16] S2: They... Instead of using 328 bits, they used literally the number four. [00:07:21] S0: Yeah. [00:07:21] S2: So their password was less secure than your ATM PIN. Yeah. And the problem with that is that because... Can we give them [00:07:28] S1: the the benefit of some four d chess? Because... [00:07:31] S0: Who would think to guess that? [00:07:32] S1: No one... No one's thinking if you were gonna try to brute force it, you would pick a number at least in the four digits Yeah. And then go from there.
00:07:32 · Jordi Hays, Matthew Prince, John Coogan
[00:07:32] S1: No one... No one's thinking if you were gonna try to brute force it, you would pick a number at least in the four digits Yeah. And then go from there. [00:07:41] S2: They had they had, I I think... I I can't remember if six or eight of their... These these key... These root these key root server certificates. The the most secure password they used was was the number 136. So they did... You know, they they they they... Again, almost to your ATM PIN [00:08:00] S0: Yeah. [00:08:00] S2: At that point. [00:08:01] S0: They call it security through obscurity. No one would... [00:08:04] S1: And they just rage they just rage quit the product category. Did I see that? I think they [00:08:09] S2: just... Yeah. They did. [00:08:10] S1: So... Which I mean... You can't fire us. You can't fire us. We quit. How [00:08:15] S2: you can ever be trusted is is is tough. But this is actually one where consumers do have something because [00:08:21] S0: Sure.