Stack Overflow, the largest online question and answer site about programming, reported a cyber attack on their resources.
In a brief statement published on the project website, it is said that on May 11, 2019, it was discovered that unknown persons had penetrated the company’s internal network. Since the time of publication of this message the investigation of the incident had just begun, no details about the attack were known. It was reported that developers quickly eliminate all vulnerabilities used by hackers and understand what happened.
On May 17, the company updated the statement, releasing a more detailed report on the incident. The developers reported that unknown attackers could still access user data, although it was initially assumed that this was not the case. Although the shared user database was not compromised, attackers could still find out the IP addresses, names, or email addresses of a small number of Stack Exchange users.
Currently, representatives of Stack Overflow continue to study the logs and deal with the actions of hackers. It is know about 250 compromised users. All the victims have already been notified of the incident.
In addition, the developers clarified that network penetration occurred as early as May 5, through a vulnerability on stackoverflow.com. The attackers remained in the system for almost a week and carried out reconnaissance, and only then began to act, increasing their privileges, which was noticed by the administration of the resource.
Currently, Stack Overflow is working with a third-party cybercriminal company and continues to investigate the incident. The attacker’s access has already been revoked, vulnerabilities have been eliminated, and the company continues a thorough internal audit of its software package and is taking a number of measures to improve protection systems.
Let me remind you that this is not the first loud hacking of the site of questions and answers. In 2018, it became aware of the attack on Quora, which resulted in more than 100,000,000 users being affected.
As an IT security services provider, Stactt offers a complete range of cybersecurity solutions: from analysis of security issues to development of information security management systems, from cyber security monitoring to the implementation of real-time security intelligence, and support of complex information security systems. Call us now and book an on-site consultation, it is free now.