According to Funk Podcast & Blog

The digression 90 – PHP alert: How a security flaw paralyzed LautFunk

Format	size	Download
MP3 Audio	26 MB	Download
AAC m4a	13 MB	Download

transcript
00:00 - 0:00:05 In this issue I will deal with it a bit and a few thoughts
0:00:05 – 0:00:08 to IT security.
0:00:08 – 0:00:17 Because the 20th of October showed us all how vulnerable and vulnerable our infrastructure is.
0:00:17 – 0:00:19 is in the whole.
0:00:19 – 0:00:22 [Music]
0:00:22 – 0:00:52 [Music]
0:00:52 – 0:00:59 Yes, hello and welcome to a new episode of digression where I occasionally, actually
0:00:59 – 0:01:06 never, but I've made it my intention to digress in every episode. I am Sasha
0:01:06 – 0:01:14 Machmann and say hello. I had given myself a few thoughts in the course of a security gap,
0:01:14 – 0:01:29 which was announced on October 20th and - let me not lie - made big waves on the 21st
0:01:29 – 0:01:39 has. Because I had been so a bit on the road between household and the usual
0:01:39 – 0:01:45 Things I do like that and then I went on Mastodon. This is so almost my
0:01:45 – 0:01:50 Favorite short message service of my choice. And then I saw that my
0:01:50 – 0:01:58 Internet provider, no not Internet provider, my hosting provider issued a message
0:01:58 – 0:02:05 had that he now, as a precaution, provided a special service that my software,
0:02:05 – 0:02:13 which provides my website, have switched off. And then I looked at why,
0:02:13 – 0:02:23 Why, why and have seen, there is a huge problem. For it had not been so,
0:02:23 – 0:02:31 that the software for my website, which is WordPress, had an error. I mean,
0:02:31 – 0:02:35 There are always errors, but they are fixed relatively quickly.
0:02:35 – 0:02:43 But it was on the server side, because the programming language PHP,
0:02:43 – 0:02:51 on which is based a variety of software out there on the Internet,
0:02:51 – 0:03:00 CMS like WordPress, Drupal, Nextcloud and so on are all based on PHP.
0:03:00 – 0:03:07 There was a massive security flaw. The interesting thing is, this security flaw is
0:03:07 – 0:03:16 known for ages. eternity. I think the first time that somehow was mentioned in 2014
0:03:16 – 0:03:24 And it has always dragged through like that. In any case, the PAP team reacted relatively quickly
0:03:24 – 0:03:36 and had in the early afternoon of 21.10. Patches provided and so could my
0:03:36 – 0:03:46 Hosting providers install the new patches and thus the problem was solved first.
0:03:46 – 0:03:58 So much for that. So if anyone was wondering why the podcast, the website and so on
0:03:58 – 0:04:07 21.10. so from about noon to early afternoon was offline, that's the explanation.
0:04:07 – 0:04:13 What is really interesting and also so striking is actually,
0:04:13 – 0:04:26 How vulnerable our infrastructure is. Yeah, great if you take a shot and call someone.
0:04:26 – 0:04:40 We were at the vulnerability of the infrastructure. Because a software provider would have to do the case yes
0:04:40 – 0:04:46 only if there is an error, adapt the software. And then would also be quasi
0:04:46 – 0:04:54 Only this product is affected. But since this gap was almost at the server level, it simply affected
0:04:54 – 0:05:04 a variety of services and yesterday on the 23rd not all services were online yet. At least
0:05:04 – 0:05:11 the surfaces of it. The services worked, but the surfaces were halt
0:05:11 – 0:05:19 unreachable. Because I think that there just on server side the patches not yet
0:05:19 – 0:05:44 were made. Because older visions than PAP 8.2 were not taken into account and actually
0:05:44 – 0:05:51 Very quickly only the 4 and the 5 were patched. The others just have a little longer
0:05:51 – 0:05:57 lasted. And older versions are not taken into account at all. First of all, you have to look at
0:05:57 – 0:06:04 Let the tongue melt. I also know this from some people from my circle of acquaintances,
0:06:04 – 0:06:11 Circle that even let things run under 7.4, 4.7.
0:06:11 – 0:06:19 Ne, 7.4, but 7.4 have run because simply the software does not evolve
0:06:19 – 0:06:30 and because after that there were always such changes in the PAP, yes, in the PAP substructure, in order to
0:06:30 – 0:06:37 To explain this quite simply and loosely, which had made it impossible to understand the visions.
0:06:37 – 0:06:44 update because certain functions have ceased to exist or functions accessed by the Software
0:06:44 – 0:06:51 has been changed in such a way that the software could not cope with it. And if there are then no updates
0:06:51 – 0:06:57 given for the software, you could not bring the substructure up to date.
0:06:57 – 0:07:05 And I think that's a big problem right now and either you take the risk,
0:07:05 – 0:07:13 that this gap is exploited or you have to wait until there are updates for the software.
0:07:13 – 0:07:21 Yes, I am glad that I use software that is being further developed and
0:07:21 – 0:07:33 it is looked at that halt the latest things are supported and how I now halt looked
0:07:33 – 0:07:40 have, with me on the server, the updates were recorded and there was also the latest
0:07:40 – 0:07:48 Version of PHP, the 8.5. That's when I thought I'd try what would happen if you
0:07:48 – 0:07:58 From four to five changes. And I have to say, interestingly, parts of the website are
0:07:58 – 0:08:04 faster now. Before, this has always felt eternities lasted, so determines five,
0:08:04 – 0:08:10 six seconds until the player is loaded for the podcast on the website. Now this is
0:08:10 – 0:08:16 Twice as fast, maybe two seconds. And I think so, that's beautiful,
0:08:16 – 0:08:26 Because there are often optimizations in the code for newer versions, where this is easy
0:08:26 – 0:08:29 is played faster or executed faster.
0:08:29 – 0:08:36 And I'm really glad that there are the developers for the plugins, the keep in the WordPress in it
0:08:36 – 0:08:41 are who also provide the podcast, all this always to a very up-to-date state
0:08:41 – 0:08:49 And even if they always say yes, we're not 100% sure if that's the case.
0:08:49 – 0:08:54 Everything works, because there are different constellations with the whole plugins, which
0:08:54 – 0:09:03 you can install for WordPress, so quasi extensions, whether all this together
0:09:03 – 0:09:04 It works.
0:09:04 – 0:09:12 They never give a guarantee, but if I try it, it runs to 99% always.
0:09:12 – 0:09:18 And now the tests I did show that the site is simply much faster.
0:09:18 – 0:09:28 I mean, I have a cache in it that keeps these PHP features being used over and over again,
0:09:28 – 0:09:33 caches, so that this does not have to be recalculated every time the
0:09:33 – 0:09:39 certain content that the site simply needs to function, i.e. from the
0:09:33 – 0:09:39 certain content that the site simply needs to function, i.e. from the
0:09:39 – 0:09:44 Database, also cached, so it simply loads faster because
0:09:39 – 0:09:44 Database, also cached, so it simply loads faster because
0:09:44 – 0:09:49 this memory is in the memory of the server and therefore natural
0:09:44 – 0:09:49 this memory is in the memory of the server and therefore natural
0:09:49 – 0:09:53 improbably fast. I don't want to go into so much detail now
0:09:49 – 0:09:53 improbably fast. I don't want to go into so much detail now
0:09:53 – 0:10:00 go and also use any technical terms for it. I don't want that now because someone,
0:09:53 – 0:10:00 go and also use any technical terms for it. I don't want that now because someone,
0:10:00 – 0:10:05 who is not interested in it now, he will then simply use thousands of terms
0:10:00 – 0:10:05 who is not interested in it now, he will then simply use thousands of terms
0:10:05 – 0:10:14 slain. But such a RADIUS server and cache, which is already really awesome, because you really
0:10:05 – 0:10:14 slain. But such a RADIUS server and cache, which is already really awesome, because you really
0:10:14 – 0:10:22 can easily cache many functions that are often needed. And not every time out
0:10:14 – 0:10:22 can easily cache many functions that are often needed. And not every time out
0:10:22 – 0:10:28 the database or from the code must be loaded, then executed, but the code is fixed and ready
0:10:22 – 0:10:28 the database or from the code must be loaded, then executed, but the code is fixed and ready
0:10:28 – 0:10:36 Hold inside this cache and can be read out very quickly and then used. Yes, I am
0:10:28 – 0:10:36 Hold inside this cache and can be read out very quickly and then used. Yes, I am
0:10:36 – 0:10:44 I'm just glad I bet on the right horses without knowing it. This is
0:10:36 – 0:10:44 I'm just glad I bet on the right horses without knowing it. This is
0:10:44 – 0:10:51 very important, that was not a decision, yes they are all future-proof, but I have
0:10:44 – 0:10:51 very important, that was not a decision, yes they are all future-proof, but I have
0:10:51 – 0:10:57 this function is in connection with my provider, who must also do this on the server side
0:10:51 – 0:10:57 this function is in connection with my provider, who must also do this on the server side
0:10:57 – 0:11:03 provide, had been picked out with me because I thought so, this is proven technology,
0:10:57 – 0:11:03 provide, had been picked out with me because I thought so, this is proven technology,
0:11:03 – 0:11:11 which is used en masse in the, yes in the professional use, then you also try it out
0:11:03 – 0:11:11 which is used en masse in the, yes in the professional use, then you also try it out
0:11:11 – 0:11:16 and I think that was the right decision, because I now have a page with the new
0:11:11 – 0:11:16 and I think that was the right decision, because I now have a page with the new
0:11:16 – 0:11:23 Version of PHP is simply faster.
0:11:16 – 0:11:23 Version of PHP is simply faster.
0:11:23 – 0:11:26 Not as fast as when I
0:11:23 – 0:11:26 Not as fast as when I
0:11:26 – 0:11:29 would now make a static page, so
0:11:26 – 0:11:29 would now make a static page, so
0:11:29 – 0:11:32 a page that has a fixed code and then
0:11:29 – 0:11:32 a page that has a fixed code and then
0:11:32 – 0:11:34 is executed, but I have a
0:11:32 – 0:11:34 is executed, but I have a
0:11:34 – 0:11:36 the dynamic side. When I get new
0:11:34 – 0:11:36 the dynamic side. When I get new
0:11:36 – 0:11:39 texts, a new blog post and so on
0:11:36 – 0:11:39 texts, a new blog post and so on
0:11:39 – 0:11:42 insert, then the stop will not be in
0:11:39 – 0:11:42 insert, then the stop will not be in
0:11:42 – 0:11:44 Code stored on the page, but in
0:11:42 – 0:11:48 a database and all these retrievals from the database always takes time and the
0:11:42 – 0:11:44 Code stored on the page, but in
0:11:42 – 0:11:48 a database and all these retrievals from the database always takes time and the
0:11:48 – 0:11:56 makes the page noticeably slower, but I have the greatest possible freedom,
0:11:48 – 0:11:56 makes the page noticeably slower, but I have the greatest possible freedom,
0:11:56 – 0:12:04 In terms of design, in terms of content. I can compensate a lot by a normal
0:11:56 – 0:12:04 In terms of design, in terms of content. I can compensate a lot by a normal
0:12:04 – 0:12:10 Cache, which almost always saves an image as a static page and always saves it
0:12:04 – 0:12:10 Cache, which almost always saves an image as a static page and always saves it
0:12:10 – 0:12:17 delivered again, because if you think about it, I don't load new content every 15 minutes
0:12:10 – 0:12:17 delivered again, because if you think about it, I don't load new content every 15 minutes
0:12:17 – 0:12:25 up. This is with me sometimes only once a week, rarely that I stop two or
0:12:17 – 0:12:25 up. This is with me sometimes only once a week, rarely that I stop two or
0:12:25 – 0:12:33 three times what do and so there are then insane speed advantages, because stop
0:12:25 – 0:12:33 three times what do and so there are then insane speed advantages, because stop
0:12:33 – 0:12:40 interlock this whole cache and virtually support each other,
0:12:33 – 0:12:40 interlock this whole cache and virtually support each other,
0:12:40 – 0:12:47 accelerating. You know what I mean? Yes, that was a short discourse in
0:12:40 – 0:12:47 accelerating. You know what I mean? Yes, that was a short discourse in
0:12:47 – 0:12:57 WordPress, infrastructure, obliques. How do I get the side that this is faster
0:12:47 – 0:12:57 WordPress, infrastructure, obliques. How do I get the side that this is faster
0:12:57 – 0:13:00 is delivered without me putting a super fast server there?
0:12:57 – 0:13:00 is delivered without me putting a super fast server there?
0:13:00 – 0:13:12 On the whole, I would say that this incident has shown that we have two points of speech.
0:13:00 – 0:13:12 On the whole, I would say that this incident has shown that we have two points of speech.
0:13:12 – 0:13:20 I mean that the software, like WordPress or something, always has some gaps
0:13:12 – 0:13:20 I mean that the software, like WordPress or something, always has some gaps
0:13:20 – 0:13:30 can. This is well known and everyone expects it. But that it stops on server side with the
0:13:20 – 0:13:30 can. This is well known and everyone expects it. But that it stops on server side with the
0:13:30 – 0:13:36 Provision of services gave rise to such problems and that is above all a problem, which so many
0:13:30 – 0:13:36 Provision of services gave rise to such problems and that is above all a problem, which so many
0:13:36 – 0:13:43 Pages are concerned. When I consider alone that about 50 percent of websites on the Internet
0:13:36 – 0:13:43 Pages are concerned. When I consider alone that about 50 percent of websites on the Internet
0:13:43 – 0:13:52 at least based on WordPress, even if these are quasi static pages, because they are not
0:13:43 – 0:13:52 at least based on WordPress, even if these are quasi static pages, because they are not
0:13:52 – 0:14:02 have changeable content, so such a one-pager or something, then that's all the more threatening,
0:13:52 – 0:14:02 have changeable content, so such a one-pager or something, then that's all the more threatening,
0:14:02 – 0:14:08 if you then have to switch off a protocol for security reasons and then quasi
0:14:02 – 0:14:08 if you then have to switch off a protocol for security reasons and then quasi
0:14:08 – 0:14:15 the whole pages all no longer work because half PHP was switched off what needed
0:14:08 – 0:14:15 the whole pages all no longer work because half PHP was switched off what needed
0:14:15 – 0:14:20 so that the pages work at all, so that they can be displayed at all.
0:14:15 – 0:14:20 so that the pages work at all, so that they can be displayed at all.
0:14:20 – 0:14:28 And of course other things. I mean, on the train, ads failed,
0:14:20 – 0:14:28 And of course other things. I mean, on the train, ads failed,
0:14:28 – 0:14:36 because it guarantees itself also via PHP somehow somewhere from a database or so stays
0:14:28 – 0:14:36 because it guarantees itself also via PHP somehow somewhere from a database or so stays
0:14:36 – 0:14:44 have pulled the data, these ads should. You just have to expect that such
0:14:36 – 0:14:44 have pulled the data, these ads should. You just have to expect that such
0:14:44 – 0:14:48 gaps can occur again and again and above all now in the current time,
0:14:44 – 0:14:48 gaps can occur again and again and above all now in the current time,
0:14:48 – 0:14:54 where we have AI that can easily search software much faster and much faster
0:14:48 – 0:14:54 where we have AI that can easily search software much faster and much faster
0:14:54 – 0:15:01 You can find any weak points. I don't know if you've noticed why
0:14:54 – 0:15:01 You can find any weak points. I don't know if you've noticed why
0:15:01 – 0:15:13 Anthropic the Fable model came out because before it there was a model that was way too strong,
0:15:01 – 0:15:13 Anthropic the Fable model came out because before it there was a model that was way too strong,
0:15:13 – 0:15:25 Need 5 and that cyber security has offered such blatant attack vectors that you can
0:15:13 – 0:15:25 Need 5 and that cyber security has offered such blatant attack vectors that you can
0:15:25 – 0:15:31 kept under wraps for the first time and published a stripped-down version out
0:15:25 – 0:15:31 kept under wraps for the first time and published a stripped-down version out
0:15:31 – 0:15:38 and very few people have access to this extremely powerful software because they were afraid
0:15:31 – 0:15:38 and very few people have access to this extremely powerful software because they were afraid
0:15:38 – 0:15:42 that it is used en masse to find vulnerabilities in software,
0:15:38 – 0:15:42 that it is used en masse to find vulnerabilities in software,
0:15:42 – 0:15:53 They are found and then exploited. Yes, these things find such
0:15:42 – 0:15:53 They are found and then exploited. Yes, these things find such
0:15:53 – 0:16:01 weak points. And that was the case in this case. A young programmer had this
0:15:53 – 0:16:01 weak points. And that was the case in this case. A young programmer had this
0:16:01 – 0:16:07 found. The interesting thing is, that's what I said at the beginning that this position has been around since
0:16:01 – 0:16:07 found. The interesting thing is, that's what I said at the beginning that this position has been around since
0:16:07 – 0:16:18 2014 is known, because this code, which was so vulnerable, was already introduced in PRP and
0:16:07 – 0:16:18 2014 is known, because this code, which was so vulnerable, was already introduced in PRP and
0:16:18 – 0:16:26 You never fixed that because you would have had to change too much about the software, but not about the software.
0:16:18 – 0:16:26 You never fixed that because you would have had to change too much about the software, but not about the software.
0:16:26 – 0:16:33 On the server side, but on the software that used this service PRP. And you just have that
0:16:26 – 0:16:33 On the server side, but on the software that used this service PRP. And you just have that
0:16:33 – 0:16:39 Not done for cost reasons. And now this has almost fallen to one's feet,
0:16:33 – 0:16:39 Not done for cost reasons. And now this has almost fallen to one's feet,
0:16:39 – 0:16:45 because I think it was Amazon, had a day before a big attack just about this gap
0:16:39 – 0:16:45 because I think it was Amazon, had a day before a big attack just about this gap
0:16:45 – 0:16:51 – and I don’t want to explain how it worked now – but it had to do with it
0:16:45 – 0:16:51 – and I don’t want to explain how it worked now – but it had to do with it
0:16:51 – 0:17:01 had that since in this PRP protocol, in this processing, memory was not properly managed
0:16:51 – 0:17:01 had that since in this PRP protocol, in this processing, memory was not properly managed
0:17:01 – 0:17:10 and that it was possible to read certain small shreds from the outside. And with that one came to the
0:17:01 – 0:17:10 and that it was possible to read certain small shreds from the outside. And with that one came to the
0:17:10 – 0:17:16 Key to breaking into Amazon's large infrastructure. That it was a day before
0:17:10 – 0:17:16 Key to breaking into Amazon's large infrastructure. That it was a day before
0:17:16 – 0:17:23 Announcing this vulnerability happens. Who knows how many systems have already cracked and
0:17:16 – 0:17:23 Announcing this vulnerability happens. Who knows how many systems have already cracked and
0:17:23 – 0:17:30 where it was invaded, without this being virtually announced, because it was not noticed,
0:17:23 – 0:17:30 where it was invaded, without this being virtually announced, because it was not noticed,
0:17:30 – 0:17:32 Because there was this security flaw.
0:17:30 – 0:17:32 Because there was this security flaw.
0:17:32 – 0:17:38 Well, that just shows,
0:17:32 – 0:17:38 Well, that just shows,
0:17:38 – 0:17:40 We just have to think a lot more.
0:17:38 – 0:17:40 We just have to think a lot more.
0:17:40 – 0:17:42 And what is also important,
0:17:40 – 0:17:42 And what is also important,
0:17:42 – 0:17:45 Always feel the update.
0:17:42 – 0:17:45 Always feel the update.
0:17:45 – 0:17:48 Thank God I have a hosting provider.
0:17:45 – 0:17:48 Thank God I have a hosting provider.
0:17:48 – 0:17:50 This is Uberspace.
0:17:48 – 0:17:50 This is Uberspace.
0:17:50 – 0:17:53 They are all extremely nerds.
0:17:50 – 0:17:53 They are all extremely nerds.
0:17:53 – 0:17:55 Some are also active members.
0:17:53 – 0:17:55 Some are also active members.
0:17:55 – 0:17:57 the Chaos Computer Club.
0:17:55 – 0:17:57 the Chaos Computer Club.
0:17:57 – 0:18:08 I also stay there in the fields and am even active in the Dortmund Chaos Computer Club
0:17:57 – 0:18:08 I also stay there in the fields and am even active in the Dortmund Chaos Computer Club
0:18:08 – 0:18:21 And also know some people about it. Yes, I can only be glad that these people are all such nerds
0:18:08 – 0:18:21 And also know some people about it. Yes, I can only be glad that these people are all such nerds
0:18:21 – 0:18:28 are and are concerned about safety, which are then very fast and very active,
0:18:21 – 0:18:28 are and are concerned about safety, which are then very fast and very active,
0:18:28 – 0:18:36 Just install these updates and patches without having to worry about it. I mean,
0:18:28 – 0:18:36 Just install these updates and patches without having to worry about it. I mean,
0:18:36 – 0:18:40 I was just thinking, try it out. I've seen that the latest version is here,
0:18:36 – 0:18:40 I was just thinking, try it out. I've seen that the latest version is here,
0:18:40 – 0:18:48 So not 4, but 8.5 and then I saw that my side is running faster,
0:18:40 – 0:18:48 So not 4, but 8.5 and then I saw that my side is running faster,
0:18:48 – 0:18:54 I'm profiting. But I don't need to worry about updates and patches now,
0:18:48 – 0:18:54 I'm profiting. But I don't need to worry about updates and patches now,
0:18:54 – 0:18:58 Because that's what my provider does. Once there is one and it is proven to be stable,
0:18:54 – 0:18:58 Because that's what my provider does. Once there is one and it is proven to be stable,
0:18:58 – 0:19:08 if it is recorded and zack, I have then almost there a version without previously known
0:18:58 – 0:19:08 if it is recorded and zack, I have then almost there a version without previously known
0:19:08 – 0:19:14 Vulnerabilities. And here we come to a certain point. I just said without
0:19:08 – 0:19:14 Vulnerabilities. And here we come to a certain point. I just said without
0:19:14 – 0:19:20 acquaintances. This does not mean that this version that is currently in use does not have a security vulnerability.
0:19:14 – 0:19:20 acquaintances. This does not mean that this version that is currently in use does not have a security vulnerability.
0:19:20 – 0:19:31 She just isn't known yet. Published. Well, I had with the last problems what I
0:19:20 – 0:19:31 She just isn't known yet. Published. Well, I had with the last problems what I
0:19:31 – 0:19:41 This concerned the plugin that provides the podcast. The Word, from WordPress, it was
0:19:31 – 0:19:41 This concerned the plugin that provides the podcast. The Word, from WordPress, it was
0:19:41 – 0:19:51 no problem at all, but it was a problem of the Potlov Publisher and that there are pictures wrong
0:19:41 – 0:19:51 no problem at all, but it was a problem of the Potlov Publisher and that there are pictures wrong
0:19:51 – 0:19:57 was cached and you could inject program code because you were in this cache
0:19:51 – 0:19:57 was cached and you could inject program code because you were in this cache
0:19:57 – 0:20:04 could write in. And so my side was infected once and I also had a
0:19:57 – 0:20:04 could write in. And so my side was infected once and I also had a
0:20:04 – 0:20:11 I did a blog post and I did a podcast episode as well. Yes, so no matter how far
0:20:04 – 0:20:11 I did a blog post and I did a podcast episode as well. Yes, so no matter how far
0:20:11 – 0:20:17 one thinks ahead and one thinks one is sure there will always be such problems and there will be
0:20:11 – 0:20:17 one thinks ahead and one thinks one is sure there will always be such problems and there will be
0:20:17 – 0:20:24 There will always be such failures and you just have to reckon with that. And if we
0:20:17 – 0:20:24 There will always be such failures and you just have to reckon with that. And if we
0:20:24 – 0:20:31 this artificial intelligence, which is now detecting these problems and vulnerabilities, and
0:20:24 – 0:20:31 this artificial intelligence, which is now detecting these problems and vulnerabilities, and
0:20:31 – 0:20:43 makes visible, helps to solve these problems, this can also become a danger if everyone
0:20:31 – 0:20:43 makes visible, helps to solve these problems, this can also become a danger if everyone
0:20:43 – 0:20:50 Strong models can use and not everyone does it in the best of intentions. The way I stop
0:20:43 – 0:20:50 Strong models can use and not everyone does it in the best of intentions. The way I stop
0:20:50 – 0:20:59 can go with a good model, write a nice piece of software, what you then "Vipe
0:20:50 – 0:20:59 can go with a good model, write a nice piece of software, what you then "Vipe
0:20:59 – 0:21:01 Coding or something.
0:20:59 – 0:21:01 Coding or something.
0:21:01 – 0:21:08 Fixed bugs in the software I wrote.
0:21:01 – 0:21:08 Fixed bugs in the software I wrote.
0:21:08 – 0:21:13 Can I also optimize software or have it written,
0:21:08 – 0:21:13 Can I also optimize software or have it written,
0:21:13 – 0:21:17 which detects weak points, investigates.
0:21:13 – 0:21:17 which detects weak points, investigates.
0:21:17 – 0:21:24 And there were already some examples and not only about the current PAP problem.
0:21:17 – 0:21:24 And there were already some examples and not only about the current PAP problem.
0:21:24 – 0:21:36 ready-made software that can be automatically scanned to find websites that can be exploited and attacked.
0:21:24 – 0:21:36 ready-made software that can be automatically scanned to find websites that can be exploited and attacked.
0:21:36 – 0:21:43 Jo, we're living what's going on in this view at a very interesting time and
0:21:36 – 0:21:43 Jo, we're living what's going on in this view at a very interesting time and
0:21:43 – 0:21:48 Yes, we should really be thinking about
0:21:43 – 0:21:48 Yes, we should really be thinking about
0:21:48 – 0:21:51 Cybersecurity.
0:21:48 – 0:21:51 Cybersecurity.
0:21:51 – 0:22:08 I know that it is now a totally stupid and banal episode, but I found this to be an important topic for me, because I have now dealt with it for a few days and have also exchanged with a few blog operators.
0:21:51 – 0:22:08 I know that it is now a totally stupid and banal episode, but I found this to be an important topic for me, because I have now dealt with it for a few days and have also exchanged with a few blog operators.
0:22:08 – 0:22:14 Or someone said, yes I'm waiting for WordPress to do an update. No.
0:22:08 – 0:22:14 Or someone said, yes I'm waiting for WordPress to do an update. No.
0:22:14 – 0:22:23 Either your provider, your hosting provider that provides your URL and website, does that.
0:22:14 – 0:22:23 Either your provider, your hosting provider that provides your URL and website, does that.
0:22:23 – 0:22:27 Or you have to change it yourself.
0:22:23 – 0:22:27 Or you have to change it yourself.
0:22:27 – 0:22:38 Yes, because with WordPress, the software that makes the website, this problem has absolutely nothing to do.
0:22:27 – 0:22:38 Yes, because with WordPress, the software that makes the website, this problem has absolutely nothing to do.
0:22:38 – 0:22:46 Ok, I thank you for listening and would be happy if you are back next time, when it is called "The Debauchery".
0:22:38 – 0:22:46 Ok, I thank you for listening and would be happy if you are back next time, when it is called "The Debauchery".
0:22:46 – 0:22:48 Goodbye, Sasha.
0:22:46 – 0:22:48 Goodbye, Sasha.
0:22:48 – 0:22:52 [Music]
0:22:48 – 0:22:52 [Music]
0:22:52 – 0:22:54 [Music]
0:22:52 – 0:22:54 [Music]
0:22:54 – 0:22:57 [Music]
0:22:54 – 0:22:57 [Music]
0:22:57 – 0:23:03 [Music]
0:22:57 – 0:23:03 [Music]
0:23:03 – 0:23:09 [Music]
0:23:03 – 0:23:09 [Music]
0:23:09 – 0:23:15 [Music]
0:23:09 – 0:23:15 [Music]
0:23:15 – 0:23:21 [Music]
0:23:15 – 0:23:21 [Music]
0:23:21 – 0:23:24 [Music]
0:23:21 – 0:23:24 [Music]
0:23:24 – 0:23:30 [Music]
0:23:24 – 0:23:30 [Music]
0:23:30 – 0:23:36 [Music]
0:23:30 – 0:23:36 [Music]
0:23:36 – 0:23:42 [Music]
0:23:36 – 0:23:42 [Music]
0:23:42 – 0:23:48 [Music]
0:23:42 – 0:23:48 [Music]
0:23:48 – 0:23:51 [Music]
0:23:48 – 0:23:51 [Music]
0:23:51 – 0:23:57 [Music]
0:23:51 – 0:23:57 [Music]
0:23:57 – 0:24:03 [Music]
0:23:57 – 0:24:03 [Music]
0:24:03 – 0:24:09 [Music]
0:24:03 – 0:24:09 [Music]
0:24:09 – 0:24:15 [Music]
0:24:09 – 0:24:15 [Music]
0:24:15 – 0:24:18 [Music]
0:24:15 – 0:24:18 [Music]
0:24:18 – 0:24:24 [Music]
0:24:18 – 0:24:24 [Music]
0:24:24 – 0:24:30 [Music]
0:24:24 – 0:24:30 [Music]
0:24:30 – 0:24:36 [Music]
0:24:30 – 0:24:36 [Music]
0:24:36 – 0:24:42 [Music]
0:24:36 – 0:24:42 [Music]
0:24:42 – 0:24:45 [Music]
0:24:42 – 0:24:45 [Music]
0:24:45 – 0:24:51 [Music]
0:24:45 – 0:24:51 [Music]
0:24:51 – 0:24:57 [Music]
0:24:51 – 0:24:57 [Music]
0:24:57 – 0:25:03 [Music]
0:24:57 – 0:25:03 [Music]
0:25:03 – 0:25:10 [Music]
0:25:03 – 0:25:10 [Music]
0:25:10 – 0:25:13 [Music]
0:25:10 – 0:25:13 [Music]
0:25:13 – 0:25:19 [Music]
0:25:13 – 0:25:19 [Music]
0:25:19 – 0:25:25 [Music]
0:25:19 – 0:25:25 [Music]
0:25:25 – 0:25:31 [Music]
0:25:25 – 0:25:31 [Music]
0:25:31 – 0:25:37 [Music]
0:25:31 – 0:25:37 [Music]
0:25:37 – 0:25:40 [Music]
0:25:37 – 0:25:40 [Music]
0:25:40 – 0:25:47 [Music]
0:25:40 – 0:25:47 [Music]
0:25:47 – 0:25:55 [Music]
0:25:47 – 0:25:55 [Music]
0:25:55 – 0:26:03 [Music]
0:25:55 – 0:26:03 [Music]
0:26:03 – 0:26:06 [Music]
0:26:03 – 0:26:06 [Music]
0:26:06 – 0:26:12 [Music]
0:26:06 – 0:26:12 [Music]
0:26:12 – 0:26:18 [Music]
0:26:12 – 0:26:18 [Music]
0:26:18 – 0:26:24 [Music]
0:26:18 – 0:26:24 [Music]
0:26:24 – 0:26:30 [Music]
0:26:24 – 0:26:30 [Music]
0:26:30 – 0:26:33 [Music]
0:26:30 – 0:26:33 [Music]
0:26:33 – 0:26:39 [Music]
0:26:33 – 0:26:39 [Music]
0:26:39 – 0:26:45 [Music]
0:26:39 – 0:26:45 [Music]
0:26:45 – 0:26:51 [Music]
0:26:45 – 0:26:51 [Music]
0:26:51 – 0:26:58 [Music]
0:26:51 – 0:26:58 [Music]
0:26:58 – 0:27:07 [Music]
0:26:58 – 0:27:07 [Music]
0:27:07 – 0:27:09 [Music]
0:27:07 – 0:27:09 [Music]

On 21 October 2026, many websites suddenly faced a serious problem: Two critical vulnerabilities in PHP forced hosting providers to take drastic protective measures. LautFunk was also affected. But what actually happened? And why can a bug in a programming language endanger so many Internet services?

In this edition of divergence I'm talking about the PHP vulnerabilities, the response of my hosting provider Uberspace and the frightening dependence of many websites on few basic technologies.

It's not just about the failure itself. I also explain why outdated PHP versions pose a significant security risk, why some operators cannot easily update their software, and why regular security updates are so important.

I also report my own attempt to switch LautFunk to PHP 8.5. The surprising result: The website continues to work and especially the Podlove Web Player loads felt significantly faster. A good reason to talk about WordPress, databases, caching and the technical basics of modern websites.

In the second part, it becomes more fundamental: What role does artificial intelligence play in the discovery of new vulnerabilities? What happens if the same technologies are used for attacks? And can we even talk about secure software as long as unknown vulnerabilities exist?

My own experiences with an earlier security incident at LautFunk are also included in this consideration.

A personal digression about PHP, WordPress, Uberspace, cybersecurity and the uncomfortable realization that our digital infrastructure is more vulnerable than we sometimes believe.

Further sources:

Uberspace – status message on the PHP security incident: https://is.uberspace.online/incidents/546
PHP.net – Security messages and publications: https://www.php.net/archive/2026.php

divergence #090 ^ | LautFunk – Thoughts, technology and everything in between.

Comparison of destructive cyberattacks with red warning signals and a protected digital cloud network

^ 🎙 themes of this episode

^ 🚨 PHP Alert: When the Internet Becomes Vulnerable

Two Critical PHP Vulnerabilities in October 2026
Uberspace's emergency response and security updates
Why LautFunk was suddenly no longer available

^ 🛡 IT Security and Digital Dependencies

PHP as the foundation of countless websites
Outdated software and underestimated security risks
Why security updates are essential
How vulnerable our digital infrastructure actually is

^ ⚙, WordPress, Podlove and PHP 8.5

My switch from PHP 8.4 to PHP 8.5
Surprisingly fast: The Podlove web player
Databases, caching and website performance
Technical dependencies of dynamic websites

^ 🤖 Artificial Intelligence and Cybercrime

AI as a tool for detecting security gaps
When artificial intelligence is used for cyberattacks
Zero-day exploits and unknown vulnerabilities
The Challenges of Modern Cybersecurity

^ 💭 Personal Experiences and Conclusion

Previous security problems with LautFunk
Why WordPress updates alone aren't enough
Between technical progress and new risks
Why There Can't Be Absolute IT Security

Advertising:

Leave feedback on the issue? ✍️ Then write a comment Audio feedback on the show? ☎️ 0231 53075818

Trustpilot

Contributors to this episode

Sascha

Number of downloads: 92
Duration: 0:27:09
Date of admission: 24.10.26
This episode is from season 4, there are a total of 4 seasons.

One According to Funk Publication Cartel Production - Where stories are transmitted unmistakably.

Podcast license:

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License

Note: This post contains affiliate links. If you shop through these links, I'll get a small commission at no extra cost to you.

So on:

The digression 61 WordPress hacked – My page in a state of emergency

Format	size	Download
MP3 Audio	25 MB	Download
AAC m4a	13 MB	Download

transcript
00:00 - 0:00:02 Music
0:00:02 – 0:00:31 [Music]
0:00:31 – 0:00:40 Hello and welcome to a new edition of the digression, where I occasionally
0:00:40 – 0:00:55 The subject is digressive. Uiuiui, what days! They were pretty intense. In short,
0:00:55 – 0:01:02 There was a hack on the Lautfunk website.
0:01:02 – 0:01:08 Jo, I had to sack that first.
0:01:08 – 0:01:10 What happened?
0:01:10 – 0:01:17 I've been wondering lately,
0:01:17 – 0:01:24 Why was the load on the server so high?
0:01:24 – 0:01:32 You have to understand, in order to have such a website on the Internet, you just need some provider,
0:01:32 – 0:01:41 In the simplest case, such a web hosting. On sides where one has a greater burden,
0:01:41 – 0:01:50 It's a good idea to have your own server. It's like a computer at home.
0:01:50 – 0:01:57 where an operating system runs on it and there is a special software, which
0:01:57 – 0:02:10 Web service offered. So you can then from outside or also at companies internally on this
0:02:10 – 0:02:19 Server access, can then use services and in my case this is just a WordPress.
0:02:19 – 0:02:32 My website consists of or builds on a WordPress background. This WordPress can be
0:02:32 – 0:02:43 Expand with plugins. What are Plugins? Plugins are a software code that provides functionality
0:02:43 – 0:02:54 Extended by WordPress. As always, software is not safe.
0:02:54 – 0:03:03 There is always a vulnerability somewhere. And even if you maintain your system regularly
0:03:03 – 0:03:09 and always plays in the updates – and this is now also the case with WordPress automatically.
0:03:09 – 0:03:20 WordPress originally comes from the blogging scene, so was for personalized blogs.
0:03:20 – 0:03:28 People kept a kind of online diary and that's what it was designed for. It is
0:03:28 – 0:03:35 It grew further, then it became a so-called content management system. You could stop
0:03:35 – 0:03:41 Upload images, short audio files, small video clips and this WordPress has it all
0:03:41 – 0:03:48 management and that makes it a particularly powerful tool today, if you
0:03:48 – 0:03:59 They want versatile websites. There are faster solutions for websites that don't have that much
0:03:59 – 0:04:05 They should have functionality, i.e. if they just show a small video
0:04:05 – 0:04:10 If you want to or just take pictures, you can do it much faster with other solutions. The pages
0:04:10 – 0:04:13 Then they are very fast.
0:04:13 – 0:04:17 But such a WordPress has the advantage,
0:04:17 – 0:04:21 that you can write comments,
0:04:21 – 0:04:24 which are immediately available.
0:04:24 – 0:04:26 Contributions are
0:04:26 – 0:04:29 Yes, with the published and immediately available.
0:04:29 – 0:04:33 The system is dynamic and expanding.
0:04:33 – 0:04:37 And that also makes it extremely complex.
0:04:37 – 0:04:40 and also vulnerable.
0:04:40 – 0:04:46 If there is a newer version of WordPress,
0:04:46 – 0:04:52 In the first few weeks, there are all wet-long updates with bug fixes.
0:04:52 – 0:04:59 And so it is with the plugins, this extension for new functions.
0:04:59 – 0:05:06 And for example, there is a plugin there, which many use, who also have a podcast
0:05:06 – 0:05:18 You have to and provide it yourself. It's called "Podlove Publisher" and that's what it's all about.
0:05:18 – 0:05:24 All the features you need for a podcast. Once that stops
0:05:24 – 0:05:31 the website is displayed, but what is much more important is that the feed, i.e. a special
0:05:31 – 0:05:40 File is generated that stops services or even stops the person himself if they want to hear the
0:05:40 – 0:05:47 You can subscribe with a podcaster. Now that's what it's all about
0:05:47 – 0:05:56 Systems like WordPress offer that comments come and go quickly.
0:05:56 – 0:06:02 It is also added to the feed. When you make new posts, every time it's in
0:06:02 – 0:06:11 Added this feed. In the early days of podcasting, this feed is still available.
0:06:11 – 0:06:17 Written by himself. This was an XML file where you entered everything by hand.
0:06:17 – 0:06:24 Where is the audio file, where is the image file and so on and so on. It was already time-consuming
0:06:24 – 0:06:32 and a hard work, if you just had many consequences, because you always keep it at the top
0:06:32 – 0:06:39 Place had to put on it. And that just takes off a pot run. You have a beautiful
0:06:39 – 0:06:49 Website where visitors can leave comments. You can do a lot more there,
0:06:49 – 0:06:54 Just like in the feed. And you also have a little bit of playful freedom,
0:06:54 – 0:07:02 that you can design that there is such a personal brand, what stops on Spotify
0:07:02 – 0:07:12 or at RTL Plus, Amazon, wherever you can listen to podcasts, just isn't there,
0:07:12 – 0:07:20 It is a standardized surface. In short, many in Germany use stop
0:07:20 – 0:07:30 the Potlov Publisher and that's exactly what had a vulnerability now. Great to explain now,
0:07:30 – 0:07:39 What happened there or something doesn't make much sense, because we're sliding into Chinese.
0:07:39 – 0:07:50 But in short, it had been possible, by a simple command, to simply
0:07:50 – 0:07:57 Web page has sent to place a file in a special area, with which you can
0:07:57 – 0:08:03 He had the opportunity to control the system. So you could have a
0:08:03 – 0:08:10 so-called backdoor, i.e. install a back door. And that's exactly what happened. And
0:08:10 – 0:08:18 What is frightening is that this happened within a few hours on many pages,
0:08:18 – 0:08:29 because this scanning process and the placement of this back door took place automatically. So
0:08:29 – 0:08:38 To all the people with whom I have talked about it and who have given me parts of their protocols on
0:08:38 – 0:08:45 From the log files, you could always see the same pattern. And so
0:08:45 – 0:08:52 A picture has emerged, also from the behavior of the site. But what do you do now,
0:08:52 – 0:08:59 Now, when your own website is affected, the most important thing in the first place
0:08:59 – 0:09:04 Keep cooler-sized. I've had a hard time with this,
0:09:04 – 0:09:09 Because it was Tuesday. I've had Tuesday anyway.
0:09:09 – 0:09:14 had a pretty shitty day and when I was in front of the computer in the evening
0:09:14 – 0:09:19 I realized there was something wrong with the website.
0:09:19 – 0:09:31 I wanted to check something else briefly, because a new blog post will be released on Thursday at the latest, which goes online.
0:09:31 – 0:09:43 And I still had a podcast that was supposed to go online on Tuesday, but somehow didn't go online on Tuesday.
0:09:43 – 0:09:48 And then I realized, the site reacts funny, it's animal slow.
0:09:48 – 0:09:54 It's an improbably high load on the system.
0:09:54 – 0:10:01 And then I turned to my provider, who takes care of the server.
0:10:01 – 0:10:05 And they said, 'There's something funny, there's something wrong.'
0:10:05 – 0:10:09 We have agreed to take the website offline.
0:10:09 – 0:10:17 The quickest way was to simply rename the directory where the website is,
0:10:17 – 0:10:23 So that it is no longer available, but I have access to all data.
0:10:23 – 0:10:29 So I just switched to the side with another program
0:10:29 – 0:10:35 And then I started pulling them all down so I could have them locally.
0:10:35 – 0:10:41 And then I noticed that in certain directories certain files
0:10:41 – 0:10:42 were.
0:10:42 – 0:10:48 After I identified the stop, I thought, well, then you do
0:10:48 – 0:10:55 Now you have a backup from three days ago, you'd have to do just a few more.
0:10:55 – 0:11:00 Replace certain files, images above all, and then it would have to run.
0:11:00 – 0:11:06 The next day, around 10 a.m., the site was re-infected.
0:11:06 – 0:11:10 And then I realized it must be a bigger thing.
0:11:10 – 0:11:17 I then took the page offline again, had looked, well, in the directories,
0:11:17 – 0:11:23 Where there were things in there before, there were things in there that weren't there before.
0:11:23 – 0:11:24 I had a clean backup installed.
0:11:24 – 0:11:33 And then it was good, now I had to see where it was. I'm back with my
0:11:33 – 0:11:40 Providers are contacted. Together we looked through the logs, the log files and there
0:11:40 – 0:11:46 We noticed a few things. That would be too technical to tell.
0:11:46 – 0:11:54 But in short, you have seen that the same path has always been taken. About one
0:11:54 – 0:12:01 special area, the cache area of the Potlov, a file was placed, after which a
0:12:01 – 0:12:07 placed another file in a different directory and so the backdoor was completely there.
0:12:07 – 0:12:18 Yes, we now knew what and how. We just didn't know how big the damage was. So
0:12:18 – 0:12:24 I sat down and wrote to Erik, the main developer of
0:12:24 – 0:12:31 On Pod Love. He had told me that he already knew about the gap a few days ago,
0:12:31 – 0:12:40 has also published a patch, but at – oh God, what is the name of the page? – in any event
0:12:40 – 0:12:49 in the case of a provider responsible for Internet security, an organisation more precisely
0:12:49 – 0:12:56 said, and filed the files there and said, you can check me if that's always
0:12:56 – 0:13:03 It is still possible to make this attack. In short, the new version, the fixed one, was clean.
0:13:03 – 0:13:10 We had written a bit with it, because I'm also a beta tester and almost also
0:13:10 – 0:13:17 a newer version, the functionality tester, whether this would also be in the version. There he sat,
0:13:17 – 0:13:22 No, he hasn't done that yet, but he does it the same way and a quarter of an hour later it was the same.
0:13:22 – 0:13:31 Updated revision. Then I sat down and sat down
0:13:31 – 0:13:39 and instead of backing up, I just installed a new WordPress,
0:13:39 – 0:13:46 this is relatively easy, then have out of the folder where all the pictures are,
0:13:46 – 0:13:51 with whom again meticulously went through and everything that is not in the picture is deleted,
0:13:51 – 0:13:59 I then uploaded it, then opened the folder where all the extensions in it
0:13:59 – 0:14:06 are, the plugins, have all installed one after the other cleanly and see there, the website
0:14:06 – 0:14:16 is back, very performant and so far I have no re-infection, because I observe,
0:14:16 – 0:14:24 I'm very precise about the system, including the entire processes that are running and I'm really glad that
0:14:24 – 0:14:31 It was so easy. In the end, it took two days and I'm sorry.
0:14:31 – 0:14:40 that the website, the podcast or the podcast-T, because there are several running about it,
0:14:40 – 0:14:48 For a while they were just offline and in no way anyone knew,
0:14:48 – 0:14:55 Which is because I wouldn't even have a so-called "main" right now.
0:14:55 – 0:15:02 trends – shit, you say differently – can make a report in any case,
0:15:02 – 0:15:11 that the site is currently offline, but is being rebuilt or something. If I had
0:15:11 – 0:15:15 I could have done it as HTML, but then I couldn't have tested it in between.
0:15:15 – 0:15:19 Because the HTML page is always there. Or I'd have a little one at home.
0:15:19 – 0:15:30 Web servers need to be virtual. Yeah, what am I supposed to say about that? It's a pretty stupid thing,
0:15:30 – 0:15:36 That's how it went and that with the infection is also a pretty stupid thing.
0:15:36 – 0:15:46 I'm sorry about the developer, the software, because he now has a bunch of people,
0:15:46 – 0:15:54 They are looking for help on the walls. Yes, you have to wait and see what happens. But this is
0:15:54 – 0:16:03 about what I have done now and that was also with the agreement of the provider
0:16:03 – 0:16:12 my server the smarter version, because to install a backup again and if necessary the
0:16:12 – 0:16:17 Having a problem that there was already a backdoor installed and that then over it again
0:16:17 – 0:16:25 Reinfection is coming, the side is just so high. I now know several people who are affected.
0:16:25 – 0:16:34 I'm sure there are still a lot of people on the road who have no idea that they are
0:16:34 – 0:16:40 have the problem. This will show up in the near future. What do we learn from this?
0:16:40 – 0:16:55 Thing that in computer science, that in IT, that in programming a wisdom always
0:16:55 – 0:17:07 He was right and is always a constant. No system is reversible. You can still go so far
0:17:07 – 0:17:14 Thinking so far into the future. I would also like to quote Erik.
0:17:14 – 0:17:21 who had written yesterday, no, today that he is now making a giant head about it,
0:17:21 – 0:17:29 whether he should have dealt with it differently, whether he might not have been able to fill the gap sooner
0:17:29 – 0:17:35 to communicate, but then in the end also risk that even more people
0:17:35 – 0:17:41 It should be noted that there is this gap. As you can see, this attack
0:17:41 – 0:17:48 was fully automated, this early communication would at most have
0:17:48 – 0:17:56 that people would have become aware of it more quickly and not to the
0:17:56 – 0:18:06 It was a time when there was almost a patch. Well, it's really stupid. I now have two
0:18:06 – 0:18:14 days, i.e. two working days for me, which is not a relation to a normal working day,
0:18:14 – 0:18:21 spent with it. Make the page work again, once without success, because I became
0:18:21 – 0:18:29 reinfected again and then the clean way. The longest thing that took in this procedure,
0:18:29 – 0:18:40 It's just the incredible amount of data. I think I'm downloading the infected version
0:18:40 – 0:18:49 There were about 72,000 files. They're tiny, that's not much. So the whole page
0:18:49 – 0:18:59 It has about 1.2 gigabytes of data. But because there are so many
0:18:59 – 0:19:05 Files are, the download process is already a bit longer. Even if I have four
0:19:05 – 0:19:11 Downloaded at the same time, it takes time. And the same is true with the
0:19:11 – 0:19:18 Upload. I have a very fast internet connection, but it's a
0:19:18 – 0:19:30 The difference is if I download with 250 megabits now, but upload with 50. There's
0:19:30 – 0:19:33 That, of course, took a little longer. But now you have to say, I don't have
0:19:33 – 0:19:38 All uploaded again, but only the folder with the pictures. These were
0:19:38 – 0:19:44 Only about 20,000 files. Now you wonder how many pictures you have on
0:19:44 – 0:19:49 this side. Yes, each picture has several
0:19:49 – 0:19:52 Visions in different sizes because I
0:19:52 – 0:19:53 It doesn't have to be a huge file.
0:19:53 – 0:19:56 on the PC with a large
0:19:56 – 0:19:59 Monitor looks really great, but on
0:19:59 – 0:20:01 The cell phone is tiny. There I can
0:20:01 – 0:20:03 Take a small file too.
0:20:03 – 0:20:07 So I have at least four sizes of
0:20:07 – 0:20:09 every picture. And then there are the
0:20:09 – 0:20:14 thumbnails that are small somewhere,
0:20:14 – 0:20:21 and there and there and schubdiwupps you just have ten files from one picture. And so added
0:20:21 – 0:20:30 That's it. This blog, or podcast, has been around since 2018, since April 2018. In this
0:20:30 – 0:20:37 Period is approximately regular, sometimes weekly, sometimes two or three times in the
0:20:37 – 0:20:44 Week, something was posted where there were pictures in it. And that's how this amount comes about. Then
0:20:44 – 0:20:52 The site itself also has pictures. These thumbnails are still taken automatically,
0:20:52 – 0:21:01 So for the page where the images are displayed for the posts. So it's just one
0:21:01 – 0:21:06 Lots of pictures that are taken. These are all small files because they are
0:21:06 – 0:21:15 It's a very low resolution, but it's just files. So much for that. So you can see,
0:21:15 – 0:21:21 if you run your own website and are not a company where you work 24 hours a day
0:21:21 – 0:21:31 If you have any contacts, then when you wake up in the morning, you already have something neat,
0:21:31 – 0:21:40 What you can experience. I thank you for your attention and say goodbye, your Sasha.
0:21:40 – 0:21:43 [Music]
0:21:43 – 0:21:46 [Music]
0:21:46 – 0:21:52 [Music]
0:21:52 – 0:21:58 [Music]
0:21:58 – 0:22:04 [Music]
0:22:04 – 0:22:10 [Music]
0:22:10 – 0:22:13 [Music]
0:22:13 – 0:22:19 [Music]
0:22:19 – 0:22:25 [Music]
0:22:25 – 0:22:31 [Music]
0:22:31 – 0:22:37 [Music]
0:22:37 – 0:22:40 [Music]
0:22:40 – 0:22:46 [Music]
0:22:46 – 0:22:52 [Music]
0:22:52 – 0:22:58 [Music]
0:22:58 – 0:23:04 [Music]
0:23:04 – 0:23:07 [Music]
0:23:07 – 0:23:13 [Music]
0:23:13 – 0:23:19 [Music]
0:23:19 – 0:23:25 [Music]
0:23:25 – 0:23:31 [Music]
0:23:31 – 0:23:34 [Music]
0:23:34 – 0:23:40 [Music]
0:23:40 – 0:23:46 [Music]
0:23:46 – 0:23:52 [Music]
0:23:52 – 0:23:58 [Music]
0:23:58 – 0:24:01 [Music]
0:24:01 – 0:24:07 [Music]
0:24:07 – 0:24:13 [Music]
0:24:13 – 0:24:19 [Music]
0:24:19 – 0:24:25 [Music]
0:24:25 – 0:24:28 [Music]
0:24:28 – 0:24:35 [Music]
0:24:35 – 0:24:41 [Music]
0:24:41 – 0:24:48 [Music]
0:24:53 – 0:24:56 [Music]
0:24:56 – 0:25:02 [Music]
0:25:02 – 0:25:08 [Music]
0:25:08 – 0:25:14 [Music]
0:25:14 – 0:25:21 [Music]
0:25:21 – 0:25:24 [Music]
0:25:24 – 0:25:30 [Music]
0:25:30 – 0:25:36 [Music]
0:25:36 – 0:25:42 [Music]
0:25:42 – 0:25:48 [Music]
0:25:48 – 0:25:59 [Music]
0:25:59 – 0:26:01 [Music]

In this episode of The digression I'll tell you how my website looks like a Hack was affected – triggered by an Vulnerability the popular podcast plugin Podlove Publisher.

I take you on a journey through chaotic days full of troubleshooting, backups, new installations and the question: As a small operator, how do you deal with such an attack?

It is about:

How I discovered the attack
Why WordPress and plugins can be a security risk
What Exactly Happened at the Podlove Gap
My Steps to Rebuild the Site Cleanly
What lessons I learned from this

A very personal episode about IT security, responsibility and the limits of software.

📖 To read on the LautFunk Blog

If you want to delve deeper into the details: On the According to Funk Blog I have extensively documented the entire incident surrounding the Podlove exploit. There you will find step-by-step explanations of what happened, how I noticed the attack and what measures I took to secure the site again.

👉 Click here for the article: LautFunk Blog - Podlove Exploit

🗂 thematic breakdown for The digression 61

Intro & Welcome
– Presentation of the episode
– Brief review: “Intense days”
The Hack on LautFunk
– First indications: Server load and slow website
– Contact with the hoster
WordPress and Plugins
– What WordPress is and why it is so popular
– Strengths and weaknesses of plugins
– Example: Podlove Publisher
Vulnerability in Podlove
– Declaration: What happened?
– Automated attacks and backdoors
– How other websites were affected
My First Attempt at Salvation
– Insert backup
– Rapid re-infection
The clean way
– Reinstallation of WordPress
– Manually checking and uploading image folders
– Reinstalling the plugins
Contact the developer
– Exchange with Erik von Podlove
– Patch and fixed version
– Role of security organisations
Challenges in Reconstruction
– Amount of data (72,000 files)
– Upload and download times
– Technical barriers for individuals
Reflection & Learnings
– No system is really secure
– Communication of security gaps
– Responsibilities of developers vs. users
Outlook & Conclusion
– Lessons for podcasters and website operators
– Thanks to the listeners:
– Adoption

Links to the issue: