Heroku: Resolved Security Vulnerability

There are different kinds of virtualization. OS-level virtualization like Linux-VServer and FreeBSD jails have little to no overhead while being very secure.

mattyb2• 16 years ago

Remember this?

http://news.ycombinator.com/item?id=362082

Do you still think that's a good idea?

catch233• 16 years ago

I don't agree with your "very slow" sentiment -- can you provide a source that shows that linux-vservers are very slow compared to running on bare metal? To my knowledge, vservers have almost no overhead vs running directly on the machine.

rst4• 16 years ago

Summary of the vuln, from the original post: Heroku was relying on unguessable filenames to keep processes associated from one app from reading files containing the config files and source code of another app. However, the random portion of those filenames was showing up in the output of 'ps' as run from (I think) 'heroku console'.

The upshot was that the filenames were easily guessable, and their contents (config files and source code of the app) easily accessible.

So, if you've had a heroku app running between December 28 and January 17, your config files are possibly compromised.

(The scary part, to me, is what a malicious party could have done with access to somebody else's database.yml, but I haven't seen any writeup specifically address that point.)

tptacek6• 16 years ago

The filenames weren't so much easily guessable as a change Heroku made last month accidentally exposed files. Relying on unpredictable strings isn't a fundamentally bad architecture; it's not an exaggeration to say that the whole web depends on that design.

My recommendation to Heroku might start with auditing every Heroku tool to make sure it calls "setproctitle".

rst4• 16 years ago

I meant to say that the filenames were easily guessable after the random strings were exposed by 'ps'.

Relying on unpredictable strings works fine, so long as you keep them away from prying eyes. But that requires attention to detail, and can get harder over time (witness, say, Firesheep, which made it a whole lot easier to hide "secret" login cookies than it used to be).

tlrobinson• 16 years ago

Hmm, I thought Heroku used chroot jails to prevent apps from seeing each other. No?

Heroku: Resolved Security Vulnerability

Related Stories