Reddit Hacked, Despite SMS Two-Factor Authentication

The hacker gained access to Reddit's internal systems by circumventing SMS-based two-factor authentication on employee accounts.

learn more about Michael Kan

By Michael Kan

via PC Mag

This story originally appeared on PCMag

Reddit on Wednesday reported a data breach. The good news? Nothing too major was likely stolen. The bad news? It involved a two-factor authentication scam.

During the mid-June intrusion, the hacker accessed an old backup of Reddit that contained user data such as hashed passwords from 2007. The culprit also viewed logs from Reddit's "email digests," which can associate a username with an email address, if you provided it.

In other words, the breach appears to have only exposed email address information for existing users and scrambled password data for long-time Reddit fans from over a decade ago.

"The attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs," Reddit engineer "KeyserSosa" said in a post detailing the security incident.

Nevertheless, the breach is raising alarm bells in the IT security community because the attacker did so by breaking into employee accounts that were supposedly protected by two-factor authentication.

These accounts were configured to not only need a password upon login, but also a special one-time passcode that would've been sent over the employee's smartphone via SMS messaging.

"We learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept," Reddit's KeyserSosa said, without elaborating.

How does a hacker go about stealing SMS messages? It's not as hard as you might think. In the past, cybercriminals have assumed a victim's identity to trick cellular providers into essentially giving them access to the person's phone number. Hackers with more technical expertise and the right hardware can also tamper with cellular technologies to collect nearby SMS messages or temporarily spoof someone's phone number.

Whatever the case may be, Reddit is using the security incident to encourage the public to switch over to non-SMS-based two-factor authentication. This involves your smartphone generating the special one-time passcode over an app. Another solution is to use a hardware-based security key, which is what Google has done to stop phishing on company employee accounts.

If you don't have two-factor authentication, it's a good idea to use it on your most important accounts, like Facebook or your bank, which can usually be activated in the settings page. Even the SMS-based authentication is better than simply protecting your account with a password.

For Reddit users who may have had their login credentials stolen in the breach, the website will reset passwords and message affected users with tips on how they can protect themselves.

"Whether or not Reddit prompts you to change your password, think about whether you still use the password you used on Reddit 11 years ago on any other sites today," the site said.

Michael Kan

Reporter

Michael has been a PCMag reporter since October 2017. He previously covered tech news in China from 2010 to 2015, before moving to San Francisco to write about cybersecurity.

Related Topics

Editor's Pick

The Dark Side of Pay Transparency — And What to Do If You Find Out You're Being Underpaid
Thinking of a Career Change? Here Are 4 Steps You Can Take to Get There.
A Founder Who Bootstrapped Her Jewelry Business With Just $1,000 Now Sees 7-Figure Revenue Because She Knew Something About Her Customers Nobody Else Did
Everything You Need to Know About Franchise Law
Collaboration

The Only Woman in the Room? That Was Me. Then I Built a Network of Career-Boosting Champions and Everything Changed.

There's an inspirational network of smart women and allies all around us. We just have to be smart about finding them. Here's how.

Starting a Business

How To Sell on Etsy in 2023: A Comprehensive Guide

Want to start selling your handmade goods online? This article outlines how to start and grow your business using Etsy.

Science & Technology

4 Reasons Low-Code Tools Will Never Replace Software Developers

While low-code tools have become a go-to solution for companies and businesses, they'll never replace developers. Here's why.

Business News

'Crying Northwestern Kid' Turned His Viral Fan Moment Into a Successful Harvard Admissions Essay. He Says the Experience Taught Him About Empathy.

Six years ago, Phillips was watching No. 8 Northwestern take on No. 1 Gonzaga during March Madness when he became a meme.