Can the Horizon Server be hacked?

Question

What is the guarantee that the Horizon Server which I am interacting is actually fetching (correct) data from ledger SQL database of Stellar Core?

Answer 1

That's a broad question. How can you guarantee that Google Mail is not hacked? Potentially, any service can be hacked, and not necessarily on the server side. For example, DNS hijacking allows hacker to redirect DNS queries to a malicious domain name server, by overriding a computer’s TCP/IP settings. This can be achieved through the use of malicious software or by modifying a server’s settings. Once the individual or individuals performing the DNS hijacking have control of the DNS, they can use it to direct traffic to different websites.

There is a set of rules that helps to protect the web app from attacks. Here is one of such checklists. HSTS settings enforce strict HTTPS policies.

So, in general, with correctly configured server and thought-out HTTPS settings you can minimize the probability of the server attack to almost zero.

What is the guarantee that the Horizon Server which I am interacting is actually fetching (correct) data from ledger SQL database of stellar core ?

First of all, you have to trust the server if it's a third-party server (in this context servers controlled by SDF are also third-party). If the server was configured correctly, and both the Horizon and the underlying Stellar Core instance are synced, you can assume that it gives you relevant information. Both Horizon and Core software is covered with extensive integration tests to guarantee that everything is working as expected.

You can also get current synchronization status (history_latest_ledger and core_latest_ledger) of the Horizon instance by fetching the root / API endpoint (like https://horizon.stellar.org/).

{
  ...
  "horizon_version": "snapshot-c5fe0ff",
  "core_version": "stellar-core 9.2.0 (7561c1d53366ec79b908de533726269e08474f77)",
  "history_latest_ledger": 18467941,
  "history_elder_ledger": 1,
  "core_latest_ledger": 18467941,
  "network_passphrase": "Public Global Stellar Network ; September 2015",
  "protocol_version": 9
}