45

I discovered a potential bugI'm having a bizarre problem, which I originally thought was environmental to my computer, but I have now been able to reproduce it two other machines. It's possible it's environmental to my company's network, but I've never seen something like this before. Attempting to enter tags causes [external] Internet connection loss. Yes, I'll repeat that because it sounds insane: "Attempting to enter tags causes the computer to lose Internet connection."

The local network works without an issue, and I can connect to any other machines and use our DFS which are within the LAN, and I can ping the local gateway or any other machine. However, attempting to access any other website / use any web service will fail. The interesting part is that DNS will still resolve IP addresses in a ping request even if you flush your DNS. It appears to only happen if I copy and paste a question I attempted to ask from Notepad into the question box.

Steps to reproduce:

Download this text file from my Google drive which contains my question that I tried to save when I realized I lost the Internet connection: https://drive.google.com/file/d/0B9k0kTfjwe8Ibk1UY3AtNzBPVnM/view?usp=sharing

  1. Create a new question and write a title. DO NOT ENTER ANY TAGS YET.
  2. Copy the entire contents of the text file
  3. Paste the contents of the text file into the question text area.
  4. Start typing into the tag field.

At step 4 if you experience the same behavior as me you'll see a JSON parsing error in the console and no tags will load, however the loading dots will continue to flash as if it was searching for tags.

Here's a screen shot of the error that shows up in the console: Error in console screenshot

This has been experienced on Windows 7 64-bit Pro, Windows 10 64-bit Pro using both Google Chrome 55 and Mozilla Firefox 50. The antivirus software installed on these machines is the corporate version of AV Defender: Security Manager AV Defender 5.3.32.780 by N-able Technologies. It appear that running ComboFix corrects the issue for the Windows 7 machines, but we're still trying to figure how a fix on the Windows 10 machine.

I was very doubtful that Stack Overflow / Stack Exchange was the problem at first because this sounds insane. I've never had an issue like this before, but I am now able to reproduce the issue in multiple places and following those above steps keeps triggering the problem.

Please be careful testing this issue. It's a PITA to fix.

PS: Anyone know the answer to my question? =)

22
  • 2
    Ouch why the downvotes? SO was is the trigger, no other sites caused this problem.
    – JNYRanger
    Dec 21, 2016 at 16:36
  • 4
    sounds like you need to contact your ISP. Dec 21, 2016 at 16:37
  • 4
    or check your antivirus because it could be filtering something. Dec 21, 2016 at 16:38
  • 2
    No repro on Win10/ Chrome
    – rene
    Dec 21, 2016 at 16:38
  • 1
    @DanielA.White It's just bizarre because I've never seen something like this and it's no other sites and it's ONLY if you follow those steps does this appear to happen. Our company's 'IT is baffled by it.
    – JNYRanger
    Dec 21, 2016 at 16:39
  • Have you asked your network administrator to take a look?
    – user247702
    Dec 21, 2016 at 16:39
  • @rene Thanks for the confirmation. It's definitely environmental to our network then.
    – JNYRanger
    Dec 21, 2016 at 16:39
  • 3
    i'd check the AV logs if it is killing the TCP stack. Dec 21, 2016 at 16:40
  • 13
    As for the downvotes, I find it hard to believe that the cause lies with Stack Overflow, so this question would only serve as a helpdesk for a problem on your company's network. (I'm guessing that's why people downvoted)
    – user247702
    Dec 21, 2016 at 16:42
  • 14
    @JNYRanger The point is that this isn't an issue about SO. This is just you having a network problem.
    – Servy
    Dec 21, 2016 at 16:44
  • 6
    @JNYRanger The "support" tag is for getting support using SO, not getting support for a problem with a network problem for your LAN, when it has nothing to do with SO...
    – Servy
    Dec 21, 2016 at 16:53
  • 8
    12 Crazy ways to get internet loss with Stack Overflow! Wait until you see what happens when he posts a question on Meta! Dec 21, 2016 at 17:21
  • 2
    i know why some sites work and others dont - HTTPS. Dec 21, 2016 at 18:43
  • 3
    It may not be so uncommon. I sometimes lose the Internet connection due to my W21 3G router stop working when using not Stack Overflow, but our evil twin, Quora (I don't remember whether the router stops working altogether or just lose the Internet connection; in any case I am forced to do a power cycle in order to reestablish connection to the Internet). It only happens using Quora. I don't know the reason; I suspect a marginal power supply and the extremely heavy use of JavaScript by Quora somehow makes the router consume more electrical power. Dec 21, 2016 at 18:46
  • 2
    @JNYRanger Try posting from a different physical location to prove your theory. If it's specific to that particular local network then the problem lies there.
    – user692942
    Dec 23, 2016 at 9:12

2 Answers 2

58

We periodically get reports from folks whose local network has some sort of filter intended to block SQL injection attacks kicking in when they try to ask questions about SQL.

I'd bet that's what's happening here.

The blocking of all other requests is something I haven't seen before; if you do get to the bottom of this, please update us on what exactly was running and what you had to do to calm it down.

10
  • 20
    If that software is indeed capable of detecting a SQL injection issues in code you might consider buying it to prevent the many mishaps posted in let's say the PHP tag. Be careful how you integrate this in your network though: Is Stack Overflow down? No, someone posted a crappy SQL question...
    – rene
    Dec 21, 2016 at 17:02
  • 6
    I've yet to see a complaint about being blocked for trying to post an actual injection attack, so... I'm not sure there's much utility there, @rene.
    – Shog9
    Dec 21, 2016 at 17:08
  • 1
    Talking by experience, maintaining a transparent proxy with some 'filters' to prevent data leakage here: The "blacklisting" of a computer for a while (usually 30 mins to let admins see the alert) when it triggers the filter and dropping the packets (causing a timeout instead of a deny) is kind of the 'out of the box' behavior. I bet this is the answer to your interrogation.
    – Tensibai
    Dec 23, 2016 at 13:46
  • @rene No, they are sadly stupid, a simple INSERT IMAGE FROM PROBLEM can trigger them :(
    – Tensibai
    Dec 23, 2016 at 13:46
  • 3
    One more reason Stack Overflow should switch to HTTPS entirely. Dec 23, 2016 at 14:09
  • 2
    @user2428118 given this kind of proxy does a MITM to inspect https, I'm unsure this would change anything.
    – Tensibai
    Dec 23, 2016 at 15:08
  • Sounds like I've been giving these networks too much credit, @tensibai; care to post an answer with more details?
    – Shog9
    Dec 23, 2016 at 15:21
  • @Tensibai Are you sure all proxies that do this filtering have SSL/TLS interception (and have it enabled)? Dec 23, 2016 at 15:22
  • 1
    Sadly there's not much to add, function named Data Leak Prevention (DLP) for PaloAlto Networks, CheckPoint has the same kind of functionnality. I may post a screenshot of what it looks like here maybe for the SSL interception. @user2428118 The SSL/TLS interception has to be configured, as it need to use a Certirficate Autority to sign again the site certificate, so not out of the box, but the configuration for SSL itnerception is easy, tweaking the 'detection' is harder.
    – Tensibai
    Dec 23, 2016 at 15:29
  • finally done it, hope i's clear enough. Tell me if there's things to explain better, I'm less comfortable to explain concept than to code them :)
    – Tensibai
    Dec 23, 2016 at 15:42
8

Seeing a Connection Timeout sounds like you're getting blacklisted from external access by a transparent proxy wich Drop your packets instead of denying them (this is a one more step to not inform a malicious program it is blocked).
The feature is called Data Leak Prevention or Data Loss Prevention (DLP)

The main idea is to act as a proxy, intercepting communications between your browser and the website while routing the traffic to the internet and inspect your POST datas. If something ring the detection, it could be a malicious software on your workstation trying to steal your data.

To avoid the leak, some firewalls will blacklist you, permanently or temporarily (the time for an admin to check the risk) depending on the score of the detected leak (more or less what an anti-spam could do to flag or delete the message). Some other will just drop the request.

For those thinking SSL could avoid this kind of things, here is how StackoverFlow certificate is signed when I visit it through our company firewall, compare with your own view:

enter image description here

The firewall just does a Man In The Middle interception, so it can see the content of the requests in clear text and make it's URL filtering and interception, it's clever enough to detect SSH on port 443 and block it (no stunnel option), in fact it verify that the exchange is valid HTTP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .