A Lesson In Security

Recently, a severe SQL Injection vulnerability was found in Drupal 7. It was fixed immediately (and correctly), but there was a problem. Attackers made automated scripts to attack unpatched sites. Within hours of the release of the vulnerability fix, sites were being compromised. And when I say compromised, I’m talking remote code execution, backdoors, the lot. Why? Like any attack, it’s a chain of issues, that independently aren’t as bad, but add up to bad news. Let’s talk about them: What went wrong? What went right? And what could have happened better? There’s a lesson that every developer needs to learn in here.

Anatomy of an Attack: How I Hacked StackOverflow

Almost two years ago I had stumbled upon a pretty significant vulnerability in the StackExchange network. I say stumbled, because I wasn’t actually trying to attack the site. Circumstance just showed me a door. The actual attack is pretty interesting, and it holds a lesson for everybody who builds or maintains websites or server infrastructure. So here’s the story on how I hacked StackOverflow…