Slashdot Mirror
A Hacker Broke Into a Few of Reddit's Systems and Managed To Access Some User Data, Company Says (reddit.com)
A hacker broke into a few of Reddit's systems and managed to access some user data, including some current email addresses and a 2007 database backup containing old salted and hashed passwords, Reddit said Wednesday. From the announcement: Since then we've been conducting a painstaking investigation to figure out just what was accessed, and to improve our systems and processes to prevent this from happening again. Reddit says the incident occurred between June 14 and June 18 when the hacker "compromised a few of our employees' accounts with our cloud and source code hosting providers." Interestingly, even as Reddit employees maintain 2FA on their accounts, the attacker managed to get access to their data. "We learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept," the company said. The company says it has a reason to believe the attacker had access to the following data: All Reddit data from 2007 and before including account credentials and email addresses. What was accessed: A complete copy of an old database backup containing very early Reddit user data -- from the site's launch in 2005 through May 2007. In Reddit's first years it had many fewer features, so the most significant data contained in this backup are account credentials (username + salted hashed passwords), email addresses, and all content (mostly public, but also private messages) from way back then. How to tell if your information was included: We are sending a message to affected users and resetting passwords on accounts where the credentials might still be valid. If you signed up for Reddit after 2007, you're clear here.
Let us be generous and assume reddit users follow accepted advice and use unique passwords on all sites. What then was actually leaked here other than making public some users who wished to remain anonymous but somehow not enough to use a unique email address as well?
Most of these email/password leaks are non events when using unique passwords yet it is a big story each time.
"few" == "most of"
"some" == "all"
Technically, they wouldn't be lying...
... steal of a backup tape or EHD by a former Reddit employee.
It little behooves the best of us to comment on the rest of us.
Something you have and now also the hacker has, lol.
One of the comments to the Reddit announcement says that Reddit got their first Head of Security less than 3 months ago!
Does /. have a dedicated Head of Security?
If not, why not? Is it a matter of cost?
This is why I don't have a Reddit, or a Slashdot, account. Can't steal information that doesn't exist.
So what site doesnâ(TM)t get hacked or at least attempted to be hacked.
Just more proof SMS 2FA is really just 1FA
It had to be a hacker! How else is msmash going to be k-rad kewl?!?
Are you talking about this incident that /. reported on earlier?
If comments can be changed so easily within their system, how can we as users be sure that this latest announcement is legitimate?
Has this disaster been confirmed through any other Reddit-management-controlled medium or media that are less likely to have also been compromised?
A) Why are they even keeping backups that old, and B) not to mention, NOT ENCRYPTED?? Basic Security fail...
.
== WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??
Hacker was found in basement having turned to a pillar of salt by looking at Raw Reddit.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
They were using SMS 2FA? Really?? That said it sounds like the number impacted was small, so at least Reddit learned from this (relatively) smaller incident instead of something bigger happening.
How is Spez supposed to access the hacked data for editing posts they disagree with?
No, Rust would not have helped secure against this attack. I think Cobol would be a better choice for critical business security.
Jesus Christ, you fucking morons, these are social media sites run by private people/companies as they please. They can edit whatever they like whenever they like in which way they like, ban people, delete posts, etc., and they wish. Run you own forum or get a fucking life, you fucking idiots!
Isn't such old data left around a violation of GDPR? I have right to see my data and ask it to be removed.
Reddit supports anonymous users. If I get compromised on one of my accounts the worst that can happen is someone posts praising Obama in r/the_donald making me lose 10,000+ karma points. Not terribly important IMHO.
Just edit the hack so the hacker only gets some ice chili recipes
State the obvious. Random anon coward flips out. ??
"I used to hold opinion X but then someone called me a 'fucking moron' told me to 'get a life'. That's when everything changed for me"
I'm AC, and this is my story.
Jesus Christ, you fucking morons, these are social media sites run by private people/companies as they please.
And others are free to criticise them as they please. Whether or not they want to run their own social media website.
They can edit whatever they like
I wouldn't be as confident as you are if it came to court. Even if there's some BS covering this in the small print of the terms and conditions, putting words in someone's mouth without it being obvious this has been done sounds legally dubious to me.
ban people, delete posts, etc., and they wish.
Yes, they can. And others are free to criticise them for this. Whether or not they want to run their own social media website.
Run you own forum or get a fucking life, you fucking idiots!
This whole post is virtually the same logic hauled out by fanboys of big companies when they're criticised. No, the fact that someone isn't pointing a gun at my head forcing me to buy (e.g.) the latest iPhone doesn't negate my right to criticise it. Or require me to design and build my own iPhone.
Logically, this would preclude criticism of the vast majority of things and remove the critical/review information that a truly free market depends upon.
'Course, the irony with such fuckwits is that they act like they're defending free markets, when in fact they're attacking a core part of their functioning.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Programming language security had nothing to do with this hack. Someone called the phone company and pretended to be a clueless customer who was trying to port his phone to a new provider. Lazy phone company rep decided that even though the "clueless customer" didn't pass any of the security questions he would go ahead and port the phone away anyway 'to be helpful'. Now the hacker can receive all SMS messages that were supposed to go to the phone. He logs into Reddit's backend as the user and it sends a 2FactorAuthentication code to the user's phone. Which the hacker is now receiving.
Sending codes as an SMS to a phone is terrible security and everyone has known this for years. Bitcoin exchanges have been very publicly hacked this way enough that no exchange would even consider using SMS for security. I'm surprised Reddit, which has a very technical community, allowed this.
BTW my bank still ONLY offers SMS security :-(
- For the complete works of Shakespeare: cat