What do you think of the reddit hack that supposedly happened?
3 years ago by Phoeniqz to c/asklemmy
Thanks for the gold kind stranger! š¤®
Crackpot idea: it's a false flag operation by reddit admins trying to sour protest support
No website is invulnerable. Since we know from Reddit's godawful official app they don't do development very well, no doubt the website also has vulnerable holes.
They didn't access the data through a vulnerability in the code, they phished some employee credentials and access it that way.
That in itself is a vulnerability. In my company we check for impossible travel, browser variance, etc. Credentials are only one aspect of this.
True, I just interpreted your comment differently to that.
If you think this will change anything at Reddit, think again.
Reddit will not pay them or meet their demands. If they do reverse any of their API changes, it won't be because of this. Businesses can't been seen to be caving to ransomware groups and rightly so, as it just encourages more of these types of attacks. ALPHV is 100% trying to cash in on the current resentment towards Reddit and it shows.
We also don't know what exactly has been accessed, as neither the group nor Reddit will confirm beyond Reddit stating that no production systems or user data was accessed. It could be 80GB of cat GIFs for all we know - I'm going to need more evidence that they have something big than a screenshot of the attacker saying "trust me bro".
Yeah, since the attack already happened in February, they just used this opportunity to make them look good ("they are doing something for the community"). However, I don't know, but it might affect stock when Reddit goes public.
I doubt it.
If they wanted to damage the IPO, they'd have done this just before the IPO was due to go live, or just after. Reddit has plenty of time to restore investor confidence before that happens.
It happened a while back and is just popping up again now because they're capitalizing on the Reddit drama. So I don't really have an opinion on them -- hacking bad, etc but I don't really care.
I've seen a few sites welcome the news with glee, as though Reddit's leadership is going to be strongly affected. That's childish and myopic. This is bad news for everyone.
Whether or not Reddit pays, we should assume the data will make its way into the hands of people who (further) weaponize it against Reddit's users, e.g. people who've posted risque photos of themselves or shared compromising details through throwaway accounts can be doxxed or matched to their normal accounts via their IP or other common details. PMs and other private account details might contain mailing addresses and other private or compromising information, too. (Edit: as Phoeniqz points out in replies, the article author assumes this is not the case based on Reddit's and BlackCat's statements about the leak.)
If Reddit knew about the breach earlier and didn't do their due diligence to alert users, then that's further condemnation of their leadership and priorities, but it doesn't undo the damage this might cause users.
If Reddit were to pay BlackCat, then it would further enrich, reward, and encourage them. If, as is more likely, it doesn't, then the blowback it receives (especially from any high profile consequences of the leak) might encourage other companies to pay up in future.
From the article:
We can be pretty sure of what to doesnāt include, and thatās user data such as account details, passwords or payment information. Thatās because, from the very start, Reddit made it quite clear that the āliveā production systems holding such data were not breached.
Thatās because, from the very start, Reddit made it quite clear that the āliveā production systems holding such data were not breached.
Because Reddit is known for being forthright and honestā¦
Yes but note the specific details of that assumption and their reasoning: it's based on reddit's announcement of the security incident a few months ago which starts:
Based on our investigation so far, Reddit user passwords and accounts are safeā¦
Now, look again at what BlackCat has promised in this leak:
Instead, BlackCat is teasing such revelations as "all the statistics they track about their users," and data concerning how Reddit "silently censors users."
80 GB of "statistics and data" about Reddit's users is a lot. It may not contain raw IP addresses, but we know that IP matching is one of the ways Reddit catches sock puppets, so there may at least be a hash that could be used to identify accounts held by the same users.
Am I going too far worrying about PMs and other details? Maybe. It really depends on the honesty and competence of BlackCat and Reddit, and the article author's assumptions based on their statements.
This is assuming that the group is telling the truth about what they found.
No user data was accessed according to Reddit.
according to Reddit
A super trustworthy source as we all know.
In the absence of literally any evidence at all to the contrary, I'm inclined to believe them for now. They seem to have followed protocol on everything else from what I've read.
I try to be skeptical until the whole story comes out. Neither party is particularly trustworthy but I have zero confidence in anything that reddit corporate says these days.
They can 100% know what was accessed and what wasnāt. This didnāt just happen, it happened in February and their SOC team or an external company would have conducted a full sweep as theyāre legally required to disclose what was breached in many of the territories they operate in, which they did four days after the incident took place. I know itās on trend to hate Reddit right now, but itās not some one man operation running on a dusty old server in a garage, itās something like the 20th most visited website on the entire internet, and that comes with certain legal obligations. They know what theyāre doing and clearly take this kind of thing seriously.
You donāt have to believe them, but thereās no proof that any user data was breached and they seem to have followed the proper protocols so far. Unless anything else comes out, Iām inclined to believe that theyāre telling the truth, or at least not lying.
My read was that BlackCat only got non-prod data. So perhaps it's sourcecode.
In which case.. they've likely got nothing of value other than the code used to track users.
@dismalnow having the code out there that Reddit uses to track accounts doesn't give me warm fuzzies. I'm not a technical guy but it seems that it would be better if that code had not been hacked and put in the hands of people with malicious intent. I have to defer to others on whether the hack compromises Reddit users' security.
it would be better if that code had not been hacked and put in the hands of people with malicious intent.
And if a frog had wings...
Now that it's out, it's best for affected parties to try to determine if immediate action is required to reduce damage to themselves via reddit's mistake - and all we have is a preliminary, and likely heavily redacted report from the company foolish enough to have allowed itself to get hacked.
So far the information points to non-production data. But the truth is that nobody knows the full scope of egressed data until BlackCat proves it, or reddit runs the fastest penetration forensics team EVER.
Therefore, it's unlikely to be user information of substance unless you e been uploading photos of your taint, connected your work email address, and have pm'd your credit card number to people.
This will make their IPO go down :D
Reddit will never financially recover from this if they go public
@lemmy.ml
A loosely moderated place to ask open-ended questions
Search asklemmy ļæ½*
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
Icon by @Double_A@discuss.tchncs.de
go to feed...
@lemmy.ml
A loosely moderated place to ask open-ended questions
Search asklemmy ļæ½*
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
Icon by @Double_A@discuss.tchncs.de
go to feed...
Probably should've invested in better security instead of trying to chase tech trends like NFTs.
save