• const_void@lemmy.ml
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    Probably should’ve invested in better security instead of trying to chase tech trends like NFTs.

  • FarceMultiplier@lemmy.ca
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    No website is invulnerable. Since we know from Reddit’s godawful official app they don’t do development very well, no doubt the website also has vulnerable holes.

    • femboy_link.mp4@beehaw.org
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      They didn’t access the data through a vulnerability in the code, they phished some employee credentials and access it that way.

  • gentleman@kbin.social
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    @Phoeniqz If Reddit is only announcing the hack now then that is very likely going to be a legal problem in a number of US jurisdictions, not to mention EU and others.

        • femboy_link.mp4@beehaw.org
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          1 year ago

          They can 100% know what was accessed and what wasn’t. This didn’t just happen, it happened in February and their SOC team or an external company would have conducted a full sweep as they’re legally required to disclose what was breached in many of the territories they operate in, which they did four days after the incident took place. I know it’s on trend to hate Reddit right now, but it’s not some one man operation running on a dusty old server in a garage, it’s something like the 20th most visited website on the entire internet, and that comes with certain legal obligations. They know what they’re doing and clearly take this kind of thing seriously.

          You don’t have to believe them, but there’s no proof that any user data was breached and they seem to have followed the proper protocols so far. Unless anything else comes out, I’m inclined to believe that they’re telling the truth, or at least not lying.

    • Phoeniqz@lemmy.dbzer0.comOP
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      The article says, the data supposedly contains information about Reddit’s tracking system. I don’t think we want that in the FediVerse

  • njinx@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Sucks that they lumped API changes into their demands. This is going to make good-faith protestors look bad.

  • femboy_link.mp4@beehaw.org
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 year ago

    If you think this will change anything at Reddit, think again.

    Reddit will not pay them or meet their demands. If they do reverse any of their API changes, it won’t be because of this. Businesses can’t been seen to be caving to ransomware groups and rightly so, as it just encourages more of these types of attacks. ALPHV is 100% trying to cash in on the current resentment towards Reddit and it shows.

    We also don’t know what exactly has been accessed, as neither the group nor Reddit will confirm beyond Reddit stating that no production systems or user data was accessed. It could be 80GB of cat GIFs for all we know - I’m going to need more evidence that they have something big than a screenshot of the attacker saying “trust me bro”.

  • tojikomori@kbin.social
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    I’ve seen a few sites welcome the news with glee, as though Reddit’s leadership is going to be strongly affected. That’s childish and myopic. This is bad news for everyone.

    Whether or not Reddit pays, we should assume the data will make its way into the hands of people who (further) weaponize it against Reddit’s users, e.g. people who’ve posted risque photos of themselves or shared compromising details through throwaway accounts can be doxxed or matched to their normal accounts via their IP or other common details. PMs and other private account details might contain mailing addresses and other private or compromising information, too. (Edit: as Phoeniqz points out in replies, the article author assumes this is not the case based on Reddit’s and BlackCat’s statements about the leak.)

    If Reddit knew about the breach earlier and didn’t do their due diligence to alert users, then that’s further condemnation of their leadership and priorities, but it doesn’t undo the damage this might cause users.

    If Reddit were to pay BlackCat, then it would further enrich, reward, and encourage them. If, as is more likely, it doesn’t, then the blowback it receives (especially from any high profile consequences of the leak) might encourage other companies to pay up in future.

    • Phoeniqz@lemmy.dbzer0.comOP
      link
      fedilink
      arrow-up
      0
      ·
      edit-2
      1 year ago

      From the article:

      We can be pretty sure of what to doesn’t include, and that’s user data such as account details, passwords or payment information. That’s because, from the very start, Reddit made it quite clear that the ‘live’ production systems holding such data were not breached.

      • tojikomori@kbin.social
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Yes but note the specific details of that assumption and their reasoning: it’s based on reddit’s announcement of the security incident a few months ago which starts:

        Based on our investigation so far, Reddit user passwords and accounts are safe…

        Now, look again at what BlackCat has promised in this leak:

        Instead, BlackCat is teasing such revelations as “all the statistics they track about their users,” and data concerning how Reddit “silently censors users.”

        80 GB of “statistics and data” about Reddit’s users is a lot. It may not contain raw IP addresses, but we know that IP matching is one of the ways Reddit catches sock puppets, so there may at least be a hash that could be used to identify accounts held by the same users.

        Am I going too far worrying about PMs and other details? Maybe. It really depends on the honesty and competence of BlackCat and Reddit, and the article author’s assumptions based on their statements.

      • SickIcarus@kbin.social
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        That’s because, from the very start, Reddit made it quite clear that the ‘live’ production systems holding such data were not breached.

        Because Reddit is known for being forthright and honest…