A deeper dive into our May 2019 security incident
stackoverflow.blog
A deeper dive into our May 2019 security incident
1–10 of 60 posts
Re: A deeper dive into our May 2019 security incident
#2I found it interesting that the attacker looked for help on the attackee's own site. I guess it truly proves how good of a repository of information StackOverflow is.
Re: A deeper dive into our May 2019 security incident
#3The report describes a security breech in 2019; the report was held back until now for legal reasons:
> Sunday May 5th
> ...a login request is crafted to our dev tier that is able to bypass the access controls limiting login to those users with an access key. The attacker is able to successfully log in to the development tier.
> Our dev tier was configured to allow impersonation of all users for testing purposes, and the attacker eventually finds a URL that allows them to elevate their privilege level to that of a Community Manager (CM). This level of access is a superset of the access available to site moderators.
EDIT: clarified that the report was held back
Re: A deeper dive into our May 2019 security incident
#4The report describes a security breech in 2019; the report was held back until now for legal reasons: > Sunday May 5th > ...a login request is crafted to our dev tier that is able to bypass the access controls limiting login to those users with an access key. The attacker is able to successfully log in to the development tier. > Our dev tier was configured to allow impersonation of all users for testing purposes, and…
The breach itself was announced shortly after it was discovered: https://stackoverflow.blog/2019/05/16/security-update/
And affected users were notified once identified, which was shortly after the announcement: https://stackoverflow.blog/2019/05/17/update-to-security-inc...
This is an update with more details, which was held back for legal reasons.
Re: A deeper dive into our May 2019 security incident
#5That was an interesting read. I'm left wondering "why" though. Anyone care to take a wild guess what they were after? That seems like quite a bit of work to be just doing it for no particular reason.
Re: A deeper dive into our May 2019 security incident
#6[deleted]
Re: A deeper dive into our May 2019 security incident
#7That was an interesting read. I'm left wondering "why" though. Anyone care to take a wild guess what they were after? That seems like quite a bit of work to be just doing it for no particular reason.
Exactly what I thought. Probably more beneficial for attacker would be to report the security vulnerabilities and receive a bounty in turn.
Re: A deeper dive into our May 2019 security incident
#8That was an interesting read. I'm left wondering "why" though. Anyone care to take a wild guess what they were after? That seems like quite a bit of work to be just doing it for no particular reason.
Given the focus on enterprise systems and teams, really looks like it was a Solarwinds type (but lower sophistication) attack where SO wasn't really the target. The targets were users of SO Enterprise or teams products.
Re: A deeper dive into our May 2019 security incident
#9I found it interesting that the attacker looked for help on the attackee's own site. I guess it truly proves how good of a repository of information StackOverflow is.
There's a new service SO could offer: help a company under attack or recently attacked correlate the methods with suspicious users on SO, based on IP addresses and the presumption that attackers would use the same system to get help as used in the attack.
Re: A deeper dive into our May 2019 security incident
#10"However, there is a route on dev that can show email content to CMs and they use this to obtain the magic link used to reset credentials."
Zawinski's Law: "Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can."