πŸš€ Submit a Challenge β€” SecDim AppSec Village CTF at DEF CON 34 and Win a ROG Xbox Ally

StackOverflow Outage

4h 20mIntermediateJavaC#JavaScriptPythonGoTypeScript

In June 2016, StackOverflow servers were unresponsive for more than 30 minutes. The issue was related to a security bug that was triggered by a malicious post. The post, which was displayed on the homepage, caused excessive CPU usage and delayed the page's response. Let's find out what the security bug was, how to detect it, and how to address it in our code.

Topics

  1. Introduction

    Lesson15m

    In July 2016, Stack Overflow had a 34-minute interruption because of a security problem. A harmful post on the main page used up too much computer power and slowed down the page. This made the load balancer take the servers offline, causing a total stop in service.

  2. ReDoS

    Lab40m

    Let’s head to the lab to discover, debug, and fix this vulnerability within an actual application.

  3. Lessons learnt

    Lesson5m

    ReDoS is a type of bug that eats up a lot of resources. It occurs when a special tool called a regular expression engine needs a huge number of steps to understand a word. This tool uses up a lot of computer power and can lead to a situation where a service is denied or stopped.