Reddit Hacked, Despite SMS Two-Factor Authentication

Reddit on Wednesday reported a data breach. The good news? Nothing too major was likely stolen. The bad news? It involved a two-factor authentication scam.

During the mid-June intrusion, the hacker accessed an old backup of Reddit that contained user data such as hashed passwords from 2007. The culprit also viewed logs from Reddit's "email digests," which can associate a username with an email address, if you provided it.

In other words, the breach appears to have only exposed email address information for existing users and scrambled password data for long-time Reddit fans from over a decade ago.

"The attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs," Reddit engineer "KeyserSosa" said in a post detailing the security incident.

Nevertheless, the breach is raising alarm bells in the IT security community because the attacker did so by breaking into employee accounts that were supposedly protected by two-factor authentication.

These accounts were configured to not only need a password upon login, but also a special one-time passcode that would've been sent over the employee's smartphone via SMS messaging.

"We learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept," Reddit's KeyserSosa said, without elaborating.

How does a hacker go about stealing SMS messages? It's not as hard as you might think. In the past, cybercriminals have assumed a victim's identity to trick cellular providers into essentially giving them access to the person's phone number. Hackers with more technical expertise and the right hardware can also tamper with cellular technologies to collect nearby SMS messages or temporarily spoof someone's phone number.

Whatever the case may be, Reddit is using the security incident to encourage the public to switch over to non-SMS-based two-factor authentication. This involves your smartphone generating the special one-time passcode over an app. Another solution is to use a hardware-based security key, which is what Google has done to stop phishing on company employee accounts.

If you don't have two-factor authentication, it's a good idea to use it on your most important accounts, like Facebook or your bank, which can usually be activated in the settings page. Even the SMS-based authentication is better than simply protecting your account with a password.

For Reddit users who may have had their login credentials stolen in the breach, the website will reset passwords and message affected users with tips on how they can protect themselves.

"Whether or not Reddit prompts you to change your password, think about whether you still use the password you used on Reddit 11 years ago on any other sites today," the site said.