Last night via the official r/reddit community, Reddit disclosed that they were pwned:
On late (PST) February 5, 2023, we became aware of a sophisticated phishing campaign that targeted Reddit employees. As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens.
After successfully obtaining a single employee’s credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems. We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).
Exposure included limited contact information for (currently hundreds of) company contacts and employees (current and former), as well as limited advertiser information. Based on several days of initial investigation by security, engineering, and data science (and friends!), we have no evidence to suggest that any of your non-public data has been accessed, or that Reddit’s information has been published or distributed online.
Reddit claims that user data is secure, but:
Since we’re talking about security and safety, this is a good time to remind you how to protect your Reddit account. The most important (and simple) measure you can take is to set up 2FA (two-factor authentication) which adds an extra layer of security when you access your Reddit account. Learn how to enable 2FA in Reddit Help. And if you want to take it a step further, it’s always a good idea to update your password every couple of months – just make sure it’s strong and unique for greater protection.
Also: use a password manager! Besides providing great complicated passwords, they provide an extra layer of security by warning you before you use your password on a phishing site… because the domains won’t match!
Now I can’t tell if Reddit is saying this because there is a legitimate threat out there that they haven’t disclosed, or this is generally good advice. Which it is good advice from my view. But if you’re a Reddit user, you should likely take their advice just in case this turns into a LastPass type of situation.
UPDATE: Monti Knode, Director of Customer Success at Horizon3.ai has this comment:
“Another successful phishing campaign isn’t a surprise and shouldn’t be. This attack vector is successful because it can look so legit, from plausible prompts to cloning their intranet gateway. This attack further reinforces the fact that the old perceptions of a perimeter are dead and gaining access is almost trivial, while understanding the blast radius of a successful attack matters more than ever.
“What can an attacker do if they landed on a specific asset? What could they do with a specific credential? In what scenario is our sensitive data at risk? These are the questions we should all be asking, because it’s not a matter of if, but when.”
Jesh Sax, Technical Account Manager at Tanium adds this:
“The techniques used at Reddit are all too familiar. Attackers are adapting to security techniques like multi-factor authentication and organizations need to take measures to mitigate potential vulnerabilities. Whether it’s physical security tokens or finding ways to authenticate both the user and the device that they’re logging in from, security teams need to continue to evolve.
“However, the fact that the user self-reported and the security team was able to catch things early on prevented this from becoming a much larger story. This speaks volumes to the culture that the security team has promoted at Reddit, where users feel comfortable speaking up when they’ve clicked on a phishing link. This type of security-aware culture is what every organization should strive for.”

Fast Company Highlights How Twitter Being Understaffed Is Coming Back To Bite Elon Musk
Posted in Commentary with tags Twitter on February 10, 2023 by itnerdIf the Platformer story that I posted earlier today isn’t enough to highlight the fact that Elon Musk and Twitter are in deep trouble, Fast Company piles on with this story that highlights how Twitter’s staffing issues are creating a death spiral for the company:
Twitter’s outage on Wednesday, which saw the site rendered unusable for most users by blocking people from tweeting within the app, accessing or sending direct messages, and following new users, shows that the social media giant is stuck in a Sisyphean nightmare.
The company needs to update its systems to enact the changes Elon Musk wants to make to the platform (things like extending the maximum tweet length and overhauling the algorithm that presents tweets to users). But, following mass layoffs by Musk, Twitter is now short-staffed, according to former staff, some of whom have contacts still within Twitter, and has been forced to instigate frequent code freezes, preventing the deployment of iterative changes to the platform’s codebase. That means vast volumes of code changes are pushed out at once when they do happen—so if anything goes wrong, it’s difficult to unpick what’s to blame.
Musk has responded to significant outages, such as the one this week, by introducing further freezes until the underlying issue is identified—which former staff say simply kicks the problem down the road.
The problem appears to be one of Musk’s own making. By getting rid of so many long-tenured staff, it appears Twitter has routed its institutional knowledge about how the platform works and interacts with other parts of the app.
Fast Company has seen conversations among former Twitter engineers suggesting that Twitter cannot identify what caused the most recent outage because it has tried to push out too many new code changes at once, and it’s impossible to identify which of the changes caused the issue. Other former Twitter engineers suggested to Fast Company that the problem of bundling so many changes into a single new release of the app is due to deploying so many code freezes.
This is like a house of cards where one wrong move will bring the entire platform down. And the blame lies with Elon as his “ready, fire, aim” mentality has not only created this situation, but will likely be the root cause of Twitter’s ultimate downfall. Which based on this and the Platformer story from earlier, illustrates that Twitter is doomed. It’s just a matter of when at this point.
1 Comment »