last day (17 days later) » 

4:02 PM
121
A: Rextester has officially been hacked. Where do we go from here?

renI'm the maintainer of rextester. First of all, it has indeed been hacked. I'm looking into it. It has happened before a few times usually someone breaking the backend. I see it as a fun process as I get to learn and then I patch the hole and the service gets more secure. Hackers probably see it ...

 
Can you share the HTML so we can see what risks we have been exposed to? Or was it completely benign?
I'd like to say thanks for a really useful resource. I'm writing this as a separate comment as it will probably get deleted for being no longer needed. :)
 
user3956566
I honestly cannot decide to up or downvote this
 
@YvetteColomb Please elaborate? Coming from a mod, what you just wrote could plausibly be interpreted as a little condescending. Not clear at all what your point is.
 
Thanks for being open and honest about this. I'm not sure about how I feel about this answer too. I'd like to think I know any site I redirect people to and found it to be secure. Now, there's an unknown vulnerability and at least one hacker knows about it and could insert malicious code in that master page at any time. Also, there are a lot of people that know the vulnerability exists now. Please let us know when the vulnerability has been found and patched.
 
user3956566
@Jean-FrançoisCorbett how it's seen as fun by the owner and possibly the hackers, yet it's something that was causing potential malicious downloads. The frank admission of it being "amateurish" is refreshing and frightening. That's where my ambivalence lies.
 
4:02 PM
I've decided to upvote this answer. True, it doesn't actually provide an answer to the question asked, but the way I see it, stepping up and accept responsibility should be encouraged. Also, I would like to thank you, ren, for Rextester. I find it very helpful not just as an online demo repository for stackoverflow, but also whenever I need to do a quick check and don't want to fire up SSMS or visual studio for it. Hope you find the security hole soon.
 
user3956566
Yeh looking at the image of when it's being hacked, it's almost looks like it's a game between the hackers (hacking the site) and the owner (trying to close the exploits). "Sorry Ren. Thanks for the inspiration L." Not a good dynamic.
 
O_o Your site is a major resource for the most active programming help site in the world. Thousands of people visit it every day from links here. @YvetteColomb is absolutely right to be concerned by the casual attitude toward security here. Regular breaches are not really acceptable. I was hesitant to take a side, but if securing this site is not a high priority, then I really have to come down on the side of editing it out. If you don't have the skill set to secure it yourself, get help. (I'm positive there are members of SE who can and would be willing to do so.) This is super important.
 
@jpmc26 I respectfully disagree. you expect such measurements from your online banking service, but I don't see why you should expect the same from a guy working on his website for fun servicing people for free. You, as a user of the internet, should choose which websites you can trust and which not. Remember - what comes for free sometimes isn't cheep at all.
 
As a website owner you're responsible to keep your website secure and peoples data as well. If you can't do that and aren't willing to get people that can, you shouldn't be running a website, period. Free or not, data security and integrity comes before all else. If people choose to use your website regardless, then that's their problem. Your website however doesn't belong on this site.
 
@deW1: kind of harsh. After all, it is not as if this site is meant to be some kind of honey trap. Assuming due diligence is normal, assuming malignant neglect is not. You are doing the latter.
 
4:02 PM
@deW1 Do you expect any 6-years-old kid that runs a "website" on a free hosting service to be a security master, or to pay people to secure their website? Also, be aware that on the terms and conditions of any major website there are statements that clears the website management from any responsibility to any damage caused to their users by using the website. They have legal teams and a part of their job is to ensure that no one can sue the website owners because of a hacker attack.
 
@YvetteColomb: "a game between the hackers (hacking the site) and the owner (trying to close the exploits)" it has been a game since from the beginning of the time (so ~1970 ;) ), both in the now-somewhat forgotten context of a positive-hacker working hard to make the technology a better and safer thing (opposed cracker/breaker who just destroys anything resembling a system), and also in the context of its dynamics in form of predator-prey game theory. Why'd that offend you or why'd think that it ought to ever change? It's at its core. It's a game by definitnion.
 
@quetzalcoatl This hack is black-hat, the site was defaced, the owner was not informed of the vulnerability used. It's a crime, not a game. Thinking of crimes as all good and fun is troubling.
 
@ren Please remember that you cannot patch a compromised server to repair it - it has to be reinstalled from scratch because you don't know what sneaky backdoors could have been left in there.
 
m69
Please join security.stackexchange.com and let them help you solve this.
 
I think people need to calm down a little. It seems to me that @ren is taking this hack seriously but using it as a fun learning exercise while taking the hack itself as a non-trivial event. Seems like a mature attitude to me.
 
4:02 PM
@YvetteColomb I felt the same way you did about not being clear on upvoting or not. Its a strange answer.
 
@ZoharPeled By that logic, we shouldn't expect SO to be secure. Furthermore, the discussion here is what to do about rextester.com links; if we have to accept they can't be trusted, then we shouldn't use them here.
 
@jpmc26: Not really. Can't you tell the difference between a company website and a personal one?
 
@ZoharPeled No. No, I cannot. Especially before I click on the link to go to it. And neither can my browser. Please explain to me what the technical difference between a personal and company site is, how my computer treats them differently. ren can have an insecure site if they want, sure, but that means we have to treat it as an insecure site that cannot be trusted.
 
Well, if you don't know where you are going, that leaves you with three options: hope for the best, protect yourself or don't go. Website owners are not responsible for your (lack of) protection - you are.
 
@ZoharPeled Um, no. Web owners are responsible for the content on their sites. If they know they don't have the skills to keep malicious content off their site and aren't taking steps to rectify that situation (other than learning after they fall victim to an attack), that's irresponsible at best. Obviously, I wouldn't sue them or anything, but we do have a responsibility as SO members to not promote vulnerable websites. The internet is dangerous enough without us telling people to go to known dangerous sites.
 
4:02 PM
@jpm26 Oh stop this, this is very offensive to Ren. Give the guy a bit of time to sort it out, not like he has a huge team of security professionals to deal with this. Things happen, hacks cannot always be foreseen, that's why they are hacks. Even the big security checking places give big companies like Google and Apple 90 days before they disclose. I bet Ren has this fixed in no time with help from the guys on security.stackoverflow.com. Your attitude is arrogant and condescending and I am offended by it.
 
 
3 hours later…
7:21 PM
@KlomDark "this is very offensive to Ren" Boo-frickety-hoo. Like it or not, these days data security is the #1 priority on the web. I gained a lot of respect for him for stepping up and accepting responsibility, and immediately lost it and more because of his completely casual attitude towards it. I get it, hacks happen. There's no such thing as an ironclad defence, even for the experts.
I don't expect every single person who runs a website to be or pay for a security expert - but I DO expect them to take the situation seriously when their users may have been compromised for trusting their service. And so far, I've seen so evidence whatsoever of the situation being taken seriously.
On top of which, jpmc26 is correct in that as SO users we do have a responsibility not to promote vulnerable websites - and rextester is clearly and definitively vulnerable, for the time being at least.
 
 
4 hours later…
11:10 PM
How major is rextester? I've been on SO practically daily for 10 years and this MSO post is the first I've heard of it.
 

  last day (17 days later) »