Timeline for A deeper dive into the May 2019 security incident: blog post feedback
Current License: CC BY-SA 4.0
21 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 15, 2021 at 5:52 | comment | added | Shadow Wizard | @Dean perfect answer, I'm truly impressed. Thanks! | |
| Jul 14, 2021 at 17:23 | comment | added | Dean Ward StaffMod | Our Enterprise product is deployed separately to anything deployed in our data centers - its membership is separate and those with elevated privileges in an Enterprise instance have no elevated access to the public sites. However the deployed code is practically identical to that used to deploy the public sites - there are some features only available in that environment but it's otherwise identical. As for the attacker's motivation - who knows? They may have thought it was a quick and easy route to get source code or maybe they just wanted their own Enterprise instance without paying... | |
| Jul 14, 2021 at 15:46 | comment | added | Anonymous | @ShadowWizardWearingMaskV2 I've changed "hacker" to "attacker", I missed the comment earlier. | |
| Jul 14, 2021 at 15:43 | comment | added | Anonymous | @JourneymanGeek Why did the articles get removed for anyone who wasn't an enterprise subscriber? | |
| Jul 14, 2021 at 15:43 | comment | added | Anonymous | @Tinkeringbell Okay, I've reworded the question. And I'm simply bringing this to their attention, to try to stop another hack before it happens while getting no information in return. | |
| Jul 14, 2021 at 15:42 | history | edited | Anonymous | CC BY-SA 4.0 |
changed "hacker" to "attacker"; reworded question, because question marks aren't allowed in this context
|
| Jul 14, 2021 at 13:47 | comment | added | Tinkeringbell Mod | @Anonymous " why was the attacker so interested in learning as much as they could about it?" ... that's the question that's there, black on white with a neat little question mark behind it. And that's a question no one but the attacker can answer. The other one/two, about what's special and if it grants developer access, are ones you'll hopefully never even get an answer to, as that would pose a huge security risk. | |
| Jul 14, 2021 at 13:42 | comment | added | Journeyman Geek Mod | Well - they could have figured a paid customer would have a better chance of getting the code, and enterprise instances, as I understand are fairly full instances of the Q&A engine, running independantly of the main public instances and teams | |
| Jul 14, 2021 at 13:41 | comment | added | Anonymous | @Tinkeringbell The first question was an indication, not asking what the hacker's motives were. My point is that it seems that there's something strange about Enterprise, and it should be patched if it weren't already. | |
| Jul 14, 2021 at 13:38 | comment | added | Tinkeringbell Mod | Why do you think anyone but the attacker would be able to answer your first question about why they were interested in this, and how big do you think your chances are for an honest answer to your second question about gaining developer access that way? | |
| Jul 14, 2021 at 13:36 | history | edited | Anonymous | CC BY-SA 4.0 |
added evidence
|
| Jul 14, 2021 at 13:34 | comment | added | Anonymous | @ShadowWizardWearingMaskV2 "Access to support documentation for our Enterprise product was limited to authorised users of that product.", under the Remediations section. | |
| Jul 14, 2021 at 13:28 | comment | added | Shadow Wizard | Where do you see that Stack Overflow restrict documentation of Enterprise teams? | |
| Jul 14, 2021 at 13:25 | comment | added | Anonymous | @ShadowWizardWearingMaskV2 But why would Stack Overflow restrict documentation of Enterprise teams? | |
| Jul 14, 2021 at 13:24 | comment | added | Shadow Wizard | Well, we can't know. I think the attacker just spread attempts randomly to any possible direction. Also please use the term "attacker", not hacker. to make is consistent with the blog, and the facts we do know. | |
| Jul 14, 2021 at 13:22 | comment | added | Anonymous | @ShadowWizardWearingMaskV2 Not necessarily. Learning the enhanced features that Enterprise teams get isn't exactly helpful for a hacker, and using a free team should have been sufficient. Additionally, "Access to support documentation for our Enterprise product was limited to authorised users of that product.". They wouldn't do that if it weren't particularly useful for a hacker. | |
| Jul 14, 2021 at 13:16 | comment | added | Shadow Wizard | Well you better add this to the answer, but still, this does not mean the attacker is interested in Stack Overflow for Teams Enterprise in particular. It's given as another example of their "probing our infrastructure, in particular parts of our build/source control systems and web servers hosting some of our development environments" activity. | |
| Jul 14, 2021 at 12:59 | comment | added | Anonymous | @ShadowWizardWearingMaskV2 "Additionally a person claiming to be one of our Enterprise customers submits a support request to obtain a copy of source code for auditing purposes. This request is rejected because we don’t give out source code and, additionally, the email cannot be verified as coming from one of our customers. It is flagged for further investigation by our support team." | |
| Jul 14, 2021 at 12:34 | comment | added | Shadow Wizard | You misread the post. What makes you believe the attacker was interested in Stack Overflow for Teams Enterprise? It was only mentioned as example for a private database/server that was not compromised, or put at risk, at all. This is written explicitly for calm those who use it down, so they know their private data was never in any kind of danger, and hopefully will never be. | |
| Jul 14, 2021 at 12:31 | review | Low quality posts | |||
| Jul 14, 2021 at 13:42 | |||||
| Jul 14, 2021 at 12:07 | history | answered | Anonymous | CC BY-SA 4.0 |