Slashdot Mirror
A Bored Hacker Easily Stole And Defaced More Than 70 Subreddits (vice.com)
An anonymous reader writes: Hacker, BVM, said he's "lost count" of the number of subreddits he's stolen and defaced, but estimates that the number is more than 70. Subreddits like r/pics, r/starwars, and r/gameofthrones, and many others, have been defaced just in the last few days. He claims Reddit's crummy security, and lack of two-factor authentication are what has made his exploits possible. "Reddit's security is shit," he says. "If Reddit would simply add 2FA it would be a lot harder to get in." Why is BVM hacking these subreddits? "No reason really. Just boredom. It's not like it's really a challenge or anything so I just do it to pass time," the hacker told Motherboard in an online chat. BVM didn't comment on how exactly he is taking over subreddits. However, he did admit he's been hacking into moderators' accounts and then changing the CSS style of the pages, replacing it with a note taking responsibility. Reddit appears to be responding to these incidents quickly, restoring the subreddits.
If true, I'm guessing it's credential reuse, phishing, or possibly XSS/CSRF. The volume hints at XSS/CSRF, but the suggestion to implement 2FA says otherwise since it may not mitigate such vulnerabilities.
so now everything is because of lack of two factor auth? fuck off
And ban him from access to anything more advanced than a leaded pencil. Vandalism is vandalism. You're bored? go help the needy or something.
"Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
Hire the bloke..
I hit the reddit/funny daily, I also use imagezoom, so that when my mouse hovers over a thumbnail I get the whole pic. Yesterday about a third of the images did not zoom, Today it was 100%. Sucks to read reddit when I have to click on each link
/ hoverzoom also doesn;t work
Reddit's pathetic politically correct SJW policy of censorship and shadowbanning is driving more and more to fight back and deface what they can in the name of freedom of speech. Proving their security is also shit is just icing on the cake.
It's really kind of pointless. I had no life at the time and nothing better to do than spend hours/days trying to infiltrate various websites. I was often successful. Once you get in you get a bit of an ego boost, poke through some data you weren't supposed to be seeing, then that's pretty much it. Most of the content was private/personal, and boring to me. I felt kind of bad sometimes. Then I got a real job and a life. All that said, I'm still shocked at how bad security is these days.
How cute, a person who has just now noticed some people that have an affiliation with each other don't like it when things aren't slanted their way. There are many more people than just the right wing that don't like it when things aren't slanted their way, of all sorts of political backgrounds. Remember little miss "what difference does it make" and I don't know much about servers but I'll run my own anyways? I don't have much of a definitive list, just picking up things as I go along, and from what I've been told the generation currently in grade school are getting the understanding that if they don't like how they are treated by staff, (a substitute teacher, for example) they can go to the office and complain. I've had bad teachers and substitutes, but I had some understanding that being able to deal with the situation prepared me for things in the future. Many of the parents of such children don't like the lessons that are different, not slanted their way, but the lessons they rail against are not the ones that are making the kids have a low tolerance. If someone hasn't already bought them like me, Goodwill stores and thrift shops should have materials that state they are for teaching common core. If that fails, I don't find it unlikely to source the materials from some other place inexpensive, relatively speaking.
But is the lockpicker inflating the count? Or from the way he talked about his exploits, letting the writer or readers' imaginations do the job for him.
And who cares?
Reddit, 4chan and similar are user-driven content sites that are and shall be easy to access. From time to time you will see things going wild on those sites and it's nothing to worry about. Better there than anywhere else.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
No one cares. Sheesh.
Losers like this should not be given this sort of oxygen of publicity to feed their fragile egos.
They're going to steal my imaginary internet points!
Seriously... who gives a shit about Reddit's security? It's a public bulletin board filled with porn, PM_Me_Your_ accounts, cat memes and throwaway accounts trolling any subreddit that actually tries to have a serious discussion. Adding two factor authorization to that is like putting a combination lock on your garbage can.
I have no idea how this website became so popular. The original interface was horrible and completely unintuitive. Years later it's one of the most popular websites on the internet and it's only slightly better. Their servers go down constantly - unable to handle even slight spikes in traffic. And their simplistic mod system has ruined the community by rewarding a lowest common denominator hive-mind.
In my mind, reddit is proof that there's no policy or formula to follow to have a successful website. Security, interface design, stability, community - none of it seems to matter. It seems to just be random what the world latches on to.
If it ain't broke, don't fix it.