3 ms·

Can't help but wonder - how obvious did the bug have to be that it was deployed on May 5th and an attacker gained access the very same day? That's pretty crazy

Can't help but wonder - how obvious did the bug have to be that it was deployed on May 5th and an attacker gained access the very same day? That's pretty crazy - and there was only one attacker who poked around for 6 days without the bug being subsequently noticed by anyone else? If I were to speculate, it seems like the work of an insider or someone close to the project. Of course, this is based on nothing but wild guesswork and it could be just coincidence. But in their shoes, I would really want to make sure no one else gained access and did anything more to hide their tracks, since it seemed like such a quickly found exploit.

bluedino 7y ago
Maybe it was a common attack/bug
- laurent123456 7y ago
  That was my thought as well. The attacker may have been probing the server for that particular bug (and probably many others) once or twice a day and so detected it almost immediately.
tedunangst 7y ago
It doesn't say the bug was deployed on May 5th.
- akersten 7y ago
  I'm looking at the following from the post: > The intrusion originated on May 5 when a build deployed to the development tier for stackoverflow.com contained a bug, which allowed an attacker to log in to our development tier as well as escalate their access on the production version of stackoverflow.com. > Between May 5 and May 11, the intruder contained their activities to exploration To me, that reads "we deployed a bug on May 5th that allowed intrusion, and it was exploited the same day." If that's not what they meant - I certainly recant my criticism - but "on May 5th when a build deployed contained a bug" is difficult for me to interpret differently.
  - sucrose 7y ago
    Exactly. If it wasn't deployed on May 5th, instead of writing, "when a build deployed to the development tier", I'd expect something along the lines of, "The intrusion originated on May 5 in the development tier".
  - tertius 7y ago
    It could have been automated and only got a hit when a bug was introduced.
- deleted 7y ago
  [deleted]
sklivvz1971 7y ago
A wild guess: they found an XSS and used it to steal a Dev cookie. Then used that to grant mod status to a throwaway user.

bluedino 7y ago

Maybe it was a common attack/bug

laurent123456 7y ago
That was my thought as well. The attacker may have been probing the server for that particular bug (and probably many others) once or twice a day and so detected it almost immediately.

tedunangst 7y ago

It doesn't say the bug was deployed on May 5th.

akersten 7y ago
I'm looking at the following from the post: > The intrusion originated on May 5 when a build deployed to the development tier for stackoverflow.com contained a bug, which allowed an attacker to log in to our development tier as well as escalate their access on the production version of stackoverflow.com. > Between May 5 and May 11, the intruder contained their activities to exploration To me, that reads "we deployed a bug on May 5th that allowed intrusion, and it was exploited the same day." If that's not what they meant - I certainly recant my criticism - but "on May 5th when a build deployed contained a bug" is difficult for me to interpret differently.
- sucrose 7y ago
  Exactly. If it wasn't deployed on May 5th, instead of writing, "when a build deployed to the development tier", I'd expect something along the lines of, "The intrusion originated on May 5 in the development tier".
- tertius 7y ago
  It could have been automated and only got a hit when a bug was introduced.
deleted 7y ago
[deleted]

sklivvz1971 7y ago

A wild guess: they found an XSS and used it to steal a Dev cookie. Then used that to grant mod status to a throwaway user.