69

This question (it's an obfuscated JS hack) allowed this user to randomly click the "Run Snippet" which then got his router hacked.

Should the Run Snippet option require a minimum reputation to prevent using SE as an attack vector? Because... um, this proved that it works...

20
  • 30
    +1, I have seen people putting java code in html/javascript 'run snippet'
    – Raju
    Commented Apr 25, 2016 at 1:20
  • 1
    Tangent: I don't mean to be a corporate shill, but... this a big motivation behind the OnHub router platform. Most consumer routers are developed by folks who are way too ignorant of security (there are many terrifying reports about how many are vulnerable), and often don't have the sort of reliable auto-update mechanisms required to maintain safety. Folks often think of them as generic interchangeable components, but they're a key component of your security. Please take this into consideration the next time y'all buy one. Commented Apr 25, 2016 at 2:00
  • 19
    With respect to this suggestion... it's definitely worth considering, but I'm not convinced. We want to encourage users to structure their posts properly from the very beginning. If they can't include a snippet directly in their post, they might link to a fiddle, or a live example on an external site instead, which could do exactly the same thing, without the viewer even having any possible opportunity to see the code before running it. At least if they're using a Snippet, the code may be visible in advance, and they won't be able to so easily change it to something nasty without notice. Commented Apr 25, 2016 at 2:05
  • 3
    I'm thinking along the lines of not allowing obfuscated code to be "Runnable". Running unknown code is never the right thing to do, but I'm not sure how to implement it. As a start, I would think to have checks in place to prevent/limit/explicitly warn regarding the eval() function?
    – Nelson
    Commented Apr 25, 2016 at 2:09
  • 9
    Snippets allow external scripts to be included, and there's no way to verify their contents before running them. There are also many ways to disguise the use of run-time code evaluation, like an obfuscated reference to the Function constructor on window. I think the marginal security benefits to any blacklist-based approach like that would not be worth interfering with the legitimate use of Snippets for demonstrating that sort of code. Commented Apr 25, 2016 at 2:13
  • While I agree that this case would have been prevented, how about anonymous users? It's not only registered users who are using the site.
    – nhahtdh
    Commented Apr 25, 2016 at 2:52
  • 5
    I got plenty of rep, but I would click that button too.
    – GolezTrol
    Commented Apr 25, 2016 at 7:49
  • 16
    Maybe we should reverse things so that you need a certain amount of rep to make a stack snippet.
    – Laurel
    Commented Apr 25, 2016 at 7:54
  • 3
    Don't go out of your way to protect users. Try to prevent malicious code like that from being posted in the first place. The problem with @Laurel's suggestion, though, is that plenty of new users with good intentions make use of the snippets.
    – Cerbrus
    Commented Apr 25, 2016 at 8:19
  • 10
    There's a rep requirement for images, isn't there? (Or there was at one point.) Low rep users just include a link to the image, and a higher rep user later comes along and inlines it. A low rep user could post his/her code, and a higher rep user (who hopefully knows a bit about what s/he's doing) comes along and converts it to a snippet. Same idea I think. It'll hopefully also fix the problem that people don't understand when you should include a snippet as opposed to just code, forcing editors to remove the snippets anyway. Commented Apr 25, 2016 at 8:25
  • 3
    Hey it's deleted now. Can someone get a screenshot?
    – Laurel
    Commented Apr 25, 2016 at 13:49
  • 2
    I think in this case we should give the writer of the malicious code (depending on why they wrote that code) with a ban from the site and delete the snippet. Shouldn't Snippets be sandboxed anyway?
    – TylerH
    Commented Apr 25, 2016 at 13:50
  • 1
    @Laurel Here's a screenshot from this post discussing the question. Commented Apr 25, 2016 at 19:44
  • 4
    Was the infection ever actually confirmed? Commented Apr 25, 2016 at 21:23
  • 1
    @JoeBlow and Raju: New users mis-using snippets is a pretty minor concern. They often horribly mis-format their code, or mis-use code style all over the place. If it's in a snippet block, at least it's formatted as a code block! It's trivial for an editor to fix that. That's way less significant than the issue being discussed here. (Though I don't think any change is warranted for either concern.) Commented Apr 26, 2016 at 22:09

6 Answers 6

46

I think the problem is not in the snippets but with the owner of the router.

If your router can be hacked by a stack snippet, it can also be hacked by a malicious banner ad or by any website for that matter. They could probably just paste the code in a JSFiddle and gain the same effect.

It would be a shame to limit this functionality just because some people might not have setup their routers properly. Especially from programmers, you would expect them to apply at least some basic level of home security.

One solution would be to limit access to the run button, but who are you protecting? Users with lots of rep would probably still press the Run button (I would).

Another option would be to limit the creation of stack snippets to users of a certain rep, but either that limit should be too high, or a hacker could easily gain that much rep. Also, they could just add the code to the question, and other users might just 'help' by converting it to a code snippet for them, without fully analysing the code (again, I would).

Scanning/checking the code might help a little, but it's probably impossible to fully analyse this kind of code automatically for such exploits. And still, JSFiddles and CodePens might also contain this code.

So in short, I'm afraid there is no proper solution on Stack Overflow's side that wouldn't limit the functionality of this nice feature, and moreover I think it's just a patch giving a false sense of security, since the user would still be as vulnerable when visiting other websites.

4
  • 18
    "If your router can be hacked by a stack snippet, it can also be hacked by a malicious banner ad or by any website for that matter." Not strictly true - I have global script denial from NoScript, but StackOverflow gets an exception since site features are fairly JS-reliant. As such, malicious scripts here automatically have an advantage over those hosted on almost any other site. I agree with the rest of your answer, though.
    – cf-
    Commented Apr 25, 2016 at 8:28
  • 14
    It should be considered abuse to put malicious code in a Stack Snippet.
    – Laurel
    Commented Apr 25, 2016 at 13:56
  • 1
    Of course, and questions containing it should be deleted and the posters should be banned. But do you want to take measures to prevent this being posted at all? I think not.
    – GolezTrol
    Commented Apr 25, 2016 at 15:09
  • 2
    @computerfreaker I don't have NoScript but I guess you should be able to trust StackOverflow in your NoScript config and still be able to block arbitrary code from stacksnippets.net
    – Oriol
    Commented Apr 26, 2016 at 12:02
21

A CSRF attack like those in the post don't require JavaScript or even a code snippet. All you would need to do is include an img tag like this:

<img src="http://192.168.0.1/?somethingbad">

See:

http://192.168.0.1/?somethingbad

Open your network panel and refresh the page and you will see the request (unless you're using NoScript's ABE feature, or some other browser firewall like uBlock Origin).

I'm afraid there's not much that can actually be done to protect users with such vulnerable routers.

3
  • You can make this worse with an inlined onload event handler on the image which then runs raw javascript. Overall I agree with your stance in the related (now deleted) question, and liked the answer you posted there. Router attacks through local script like that are an interesting vector to consider.
    – Travis J
    Commented Apr 25, 2016 at 23:38
  • 1
    @TravisJ Thankfully SE is smart enough to strip out onload handlers (I just double-checked). Would be usable for off-SE attacks though. Commented Apr 25, 2016 at 23:40
  • 2
    @TravisJ That wouldn't be a CSRF attack, that'd be a XSS attack on SE. Also that would require a serious security vulnerability in SE in order for it to work. Pulling that off would mean the attacker gets to perform any action on your SE account as you if you view it while logged in. StackSnippets prevents this by running everything in a sandboxed iframe, and SE (outside of StackSnippets) prevents it by not letting you include any code at all in your post in a context that might cause it to be executed by your browser.
    – Ajedi32
    Commented Apr 26, 2016 at 17:47
17

I think the problem is not with the owner of the router, but with the snippets.

Now, the reason I am going to talk will seem like a bit of a stretch at first, but it's still a valid argument.


Why something has to change

Before reading about this post, I thought that I could feel safe running snippets here on Stack Overflow. When I download torrents, I know that I have to look out for all of the obtrusive ads that blast "Download NOW" or "Start download" and carefully tread through whichever sketchy website I'm on to make sure that I download the torrent I'm looking for, from the website that I'm expecting to download it from.

Compare this experience with using Stack Overflow. When I log onto Stack Overflow, I don't have to look through ads pretending to be the login button which would really lead me to a phishing site. Instead, I look for the only "login" button on the page, and I type in my credentials without worrying about the security involved.

Now imagine if Stack Exchange one day decided to allow advertising on their network. If the same advertisers from the torrent websites came to advertise here they could have their ads exclaim, "Log on here!", or even worse, they could mimic the actual login button/form. If an ad was obtrusive and well designed, it could possibly stand out and seem as though it was the actual legitimate login form.

Without being warned about this new advertisement, and without ads on any other page, a user could visit the login page, click login, and unknowingly be lead to a phishing scam.

Now, would this ever happen? NO.

So, what point does it make? This:

If the above scenario ever did happen, if Stack Exchange allowed advertisements and didn't care who advertised and didn't check the ads and allowed the ads to be absolutely too obtrusive, then I think many users would visit the site and see this fake login button and without noticing any difference, fall for the scam. Not because the scam was just too perfect, but because they weren't looking for possible threats. Why not? Because they're on Stack Overflow, not CoolestLegitTorrents.gov.net.biz.

Users trust Stack Exchange to not present them with any possible malicious threats.


The bottom line

I told you it was a bit of a stretch. But it makes the point that users on Stack Exchange are not only not looking for threats, they're browsing the site thinking that nothing can go wrong. Maybe not nothing, but at least thinking nothing is likely to go wrong.

The scenario I talked about would never happen. But, let's apply this situation to the snippets.

If I was given a link to a jsFiddle, I would want to look over all of the code before running it. I would at the very least, give it all a glance over to make sure I had some idea of what each part was doing. I don't know how much I should trust jsFiddle, so I exercise the same caution I would when I visit any site I'm not familiar with.

However, if I was presented with a snippet on Stack Overflow, I wouldn't know how much caution to exercise. I trust Stack Overflow more than I trust a site like jsFiddle, so I'll be less wary of snippets here than I would of code there. Surely SO has implemented something to prevent malicious code from getting through. Surely the code is ran on their servers and I only see the result... right?

The bottom line is, I don't know how much to trust snippets on Stack Overflow, so I'll trust them as much as I trust Stack Overflow. I don't expect the possibility of a virus, or a hack, or anything malicious, from any link on this network that doesn't take me away from the page I'm on, so I'll apply that logic to snippets as well. Stack Overflow never told me how much to trust them, so shouldn't I trust them as much as I trust SO? It's only default.

Since Stack Overflow never gave me any warning or any advice on this feature, I'll only assume that is because they've made it safe enough for me to not worry about.


Why the opposite argument is illogical

If we went with the "well any user smart enough should know better" argument, then we wouldn't have any new users. Any user smart enough would know how to make a good question, but we still have a "How to ask" guide. Why is that?

If we only wanted users "smart enough to know better" then we wouldn't have any guide or material for new users and we would simply delete every question that wasn't "good enough" for the network and not give the user a reason for doing so.

We don't do that though. If a question isn't found to be on topic, or isn't clear enough, it's put on hold for a few days and the author is told how it can be improved. We want these users. We want their questions. But, we know that making a good question on your first try isn't always the easiest thing to do so we have resources like guides, and perhaps most importantly... we have warnings.

Before posting a question, users see not one but two large panels with information and links on how to ask and how to format their questions. Why is this there?

The warnings are there because SO doesn't expect its users to be perfect.

Since SO knows that its users aren't perfect, it provides resources to make sure that users don't make the mistake of posting a low quality question.

Since SO knows that its users aren't perfect, shouldn't it at least warn users that the snippet feature isn't guaranteed to be safe?


What can be done?

It is very clear that the SO users aren't perfect, and aren't expected to be either. But what can be done, and why?

First:

  • Why does anything need to be done?

Until being told otherwise, I think that features on the Stack Exchange network should be treated the same. Unless a link/feature takes you away from the site you're on, you can trust it to not be malicious.

I think that this is perfectly reasonable.

I wouldn't expect clicking on a question to end up being malicious. I wouldn't expect reviewing to be able to lead me anywhere malicious.

I wouldn't expect any feature on this site to be malicious, but if one could possibly be malicious, I would expect Stack Overflow to give me a warning.

If every feature on Stack Overflow is safe and has virtually zero chance of being an attack vector, except one, wouldn't you warn users about the one not being as secure as the others?

Second:

  • What can be done?

A simple warning.

  • Maybe a little bit of text below every "Run Snippet" button that says, "Remember to exercise caution when running snippets. Don't run unless you know what the code does." or anything like that.

Or,

  • A warning that pops up the first time you run a snippet.

Or,

  • Some text somewhere when you sign up, or when you read a post with a snippet.

But something, at least.

This argument is the same for users who have been here any amount of time, with any amount of reputation, so I don't think reputation is going to solve the problem. Everyone needs to know.

9
  • 20
    "If I was given a link to a jsFiddle, I would look over all of the code before running it." No, you wouldn't: it runs automatically as soon as you load the page, and the code isn't visible at all if you have JavaScript disabled. Commented Apr 25, 2016 at 22:35
  • I see, edited. Jeremy, if SE has a license on all of the code posted, does anything change if you "dedicate" it under another license?
    – Matt C
    Commented Apr 25, 2016 at 22:40
  • 1
    People's ability to use my code under Stack Exchange's license terms is unchanged; I cannot impose additional restrictions on that. But by releasing it under another license (such as in my profile), I am giving readers the alternative of using it under those terms instead of Stack Exchange's terms. Commented Apr 25, 2016 at 22:43
  • 7
    I agree that "smart enough to know better" is a ridiculous argument, and an irresponsible approach to security. But I don't think there's any coherent, consistent way to address this concern. If you want a warning beside the "run" button, you should also have a warning before the user clicks any link, because they pose the same risk (if we ignore the infinitesimal fraction of users running NoScript). Also, as Alexander O'Mara pointed out, some of these router attacks don't even require JavaScript, but can be also activated by a standard image tag. Should we also hide those by default? Commented Apr 25, 2016 at 22:45
  • So your code will fall under any license less strict than SE's, if you say it will?
    – Matt C
    Commented Apr 25, 2016 at 22:47
  • In my case, the license is less strict than Stack Exchange's in every way, and it should be compatible with a superset of the licenses that Stack Exchange's is compatible with. But that doesn't need to be that case. I could also release my code under an additional license that has an entirely different set of restrictions than Stack Exchange, such as "you may use this code without attribution as long as you include a photo of a red bird in your about page", and users would be able to chose which set of restrictions they want to comply with. (Oblig: I am not a laywer, this is not legal advice.) Commented Apr 25, 2016 at 22:49
  • "Now imagine if Stack Exchange one day decided to allow advertising on their network". Stack Exchange has advertising.
    – Oriol
    Commented Apr 26, 2016 at 12:06
  • 1
    I completely agree. I would at least like a warning if something is potentially malicious, as I do have a high trust in this site that would not have been dented had I not had knowledge of this whole ordeal. Commented Apr 26, 2016 at 12:38
  • @MatthewCliatt Yes? You are effectively dual-licensing. It can even be differently strict -- ie, allow people to use your code in ways SO license does not, but require something else in exchange. As an example one could say "All of my code on SO is available at the cost of 1 million dollars per non-whitespace character to be used without attribution." This doesn't have the attribution requirement of the SO license, but has additional requirements that the SO license does not have (a million here, a million there, soon it can add up to real money) Commented Apr 26, 2016 at 17:47
6

Based on how popular my comments were, I decided to make a full answer.

Maybe we should reverse things so it takes a minimum amount of rep to include a Stack Snippet - (Originally here)

We already have certain limitations on new users. I have never seen anyone question the fact that we do not allow new users to include images. Images can be bad in a number of ways, such as being advertisements, porn, or web beacons.

It seems logical to apply the same restriction to Stack Snippets. For all the security reasons mentioned, but also because they can essentially be used to include images in a post.

If we restrict the use of Stack Snippets, then we can also better regulate how and when they are used.


It should be considered abuse to put malicious code in a Stack Snippet. (Originally here)

There currently are penalties for trolls and spammers. I see no reason that we can't apply the same logic to spammy or trolling code.

Like I said before, there's nothing stopping a user from slyly advertising with a Stack Snippet, especially when they also have a question.

There's also nothing stopping trolls from doing the same with malicious code. This is TERRIFYING. Consider how many new users like to lash out against the community by ranting, posting mean comments, and down voting (if they can). Now imagine that these people were clever enough to realize they could get revenge with a Stack Snippet.

Even if there is no bad intention, there should be some consequence for users that post malicious code.

4

Thanks for bringing this up.

GolezTrol's answer sums up our team's thoughts on the matter nicely. It's one of those, "build a better mousetrap and they'll build a better mouse" things.

Alexander's answer also makes the point that this really has little to do with Stack Snippets. A malicious user could easily implement the same or similar using image embeds in a regular question post that contains no Stack Snippet. What should we do in that case? One might demand that we "analyze" either img links or Stack Snippets code in order to defeat the issues, but that's a slippery slope. The best approach is to educate users as much as possible.

Regarding Stack Snippet controls: downvote any malicious post, and flag things that abuse the system (like that router hijacking code). Once a post reaches the per-site configured value for downvote threshold, the post is grayed out and the Stack Snippet is disabled. If moderators see the flag, they can delete the post (or code). This is the power that the community holds over Stack Snippets.

I agree with the side commentary that there are some usage issues with Stack Snippets. People posting Java and the like, not understanding that it's a JS, CSS, and HTML tool. We need to work on those, but that's outside of the scope of this discussion.

One thing we need to do is find a way to make it clearer that Stack Snippets run code in your browser. We'll work on this and continue to improve Stack Snippets in general.

0

I would definitely disable:

  • Posting Stack Snippets for users with < X rep (threshold at staff's discretion)
  • Running Stack Snippets for anonymous users
  • Running Stack Snippets for users that did not previously opt-in for them

Alternate to 1: enabling a Stack Snippet only after peer review by users with review privileges (e.g. I can review on SO, but not on SU)

Preventing run for anonymous users is simply a way to protect the most inexperienced.

Finally no matter the sandbox I would pay great attention to user-posted code. After tons of articles about do not trust user input ([1] [2] and a lot more) how dare you allow people to run Javascript on another person's computer with the press of a button? Kidding...

I don't think that working on a heuristic Javascript scanner (eval is first candidate to evilness) to block script is a good idea. We don't need a Javascript antivirus :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .