I am impressed with the way Stack Overflow is handling this, but I would appreciate details about how a bug in the development tier gave an attacker the ability to escalate their access in production. Does the development tier have production keys? Did the attacker learn about some other bug through access to the development tier? Is the development tier sharing a privileged private network with the production tier? Hopefully the security community can learn from this incident to improve best practices.
This is obviously speculation, but development does not require direct access for a pivot to production. CI-Systems might be reachable from dev and I often see CI-Systems that are less well secured than prod. Pivoting from an owned CI to a prod system is often comparatively easy: inject code in the next build, the artifact is implicitly trusted (hey, itβs from a known-good source) and bang! Prod owned. Or developers expose their ssh keys via agents to dev systems, the same key works for prod and you might be in.
Which is why best practice is now to start with CI in production - it needs limited access to dev, and the access from development environments into it can be literally just enough to collect the latest artifact.
It's not clear to me that "development tier" means "a development environment." I interpreted it as the standard StackOverflow.com infrastructure that developers use -- this is contextualized a few paragraphs later when they mention "we maintain separate infrastructure and networks for clients of our Teams, Business, and Enterprise products", which implies that the production environment that was compromised was something other than those three.
(Even if I'm right, though, I definitely agree that the wording is very easy to misinterpret and they should clarify the post to explain what the "development tier" is.)
