Hacker News Reader

Comment by packetized | Hacker News Reader

Interesting that the data accessed was very specifically only limited to:

* A complete copy of an old database backup containing very early Reddit user data -- from the site’s launch in 2005 through May 2007

* Logs containing the email digests we sent between June 3 and June 17, 2018

Also of note:

"Already having our primary access points for code and infrastructure behind strong authentication requiring two factor authentication (2FA), we learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept."

If this doesn't put the nail in the coffin of SMS-based 2FA, I'm not sure what will.

View on HN

we learned that SMS-based authentication is not nearly as secure as we would hope

Yeesh, what is going on with their security team over there? Years ago it was "oh, now we realize why everyone was saying that storing passwords in plaintext is a bad idea." Now it's "oh, now we realize what a bad idea SMS auth is."

So what is Reddit doing today that you and I would think, "of course, no one does that anymore 'cuz 'duh'." but they think, "nah, it's still okay."?

It sounds like Reddit just recently hired security. It's not at all unusual for companies of Reddit's size not to have a security team; the only thing that makes them noteworthy in that regard is how old the company is. If your expectation is that most of the companies you've worked with or availed yourself of have dedicated security teams, revise your expectations sharply downwards.

It's not at all unusual for companies of Reddit's size not to have a security team;

Well, by "security team" I meant "people that should know better". I mean, raise your hand if you knew even ten years ago what a bad idea it was to store passwords in plaintext. Okay, now keep your hand up if you're job role includes the words "security team". Hmm, not a lot of hands left. You don't need a dedicated security team to figure out that some folks, including the CEO, shouldn't be let anywhere near the database nor making design decisions.

Reddit had a security team, they just haven't had the position "Head of Security" until now[0]. They did have a policy of using TOTP but couldn't enforce it on certain providers (applications?) [1].

[0]: https://old.reddit.com/r/announcements/comments/93qnm5/we_ha...

[1]: https://old.reddit.com/r/announcements/comments/93qnm5/we_ha...

Question. I am curious in general in that, how can they say that "this" data was compromised, but "that" data was not?

How does that work? Do they really have some low-level access log that shows who accessed what file and at what time?

And then, do they keep that log for some months at least?

And, can they query that log and declare that, six months ago, "this" data was compromised, but "that" data was not?

How does all that work.

They probably knew what systems were accessed via centralized logging. By extension, you know what that system had access to.

That is not what data it was limited to at all. That is the data they are highlighting because it affects their users the most.

Here is the list of what of what they are saying they got access to: https://news.ycombinator.com/item?id=17665254

Can you or someone else explain/link to me the basics of why SMS-based 2FA is so terrible? I've never really heard the sentiment before, but it appears to be common knowledge.

TOTP clients cannot be intercepted where as sms tokens can be compromised in a variety of ways.

TOTP tokens can absolutely be intercepted. A MITM attack can work like this:

1) User inputs username and pw into spurious site.

2) Spurious site prompts for the user's TOTP token.

3) Spurious site proceeds to immediately log in to the real site w/ username, pw, and valid TOTP token.

4) Bad guys get an HTTP session cookie which for many sites lasts practically indefinitely.

Telephone companies are insecure and susceptible to social engineering, and their backup authentication schemes often rely on publicly accessible information. This enables attackers to hijack the account and reassign the phone number to a device they control.

https://twitter.com/Magoo/status/1024714909395824640

Its too easy to hijack someone's phone number by socially engineering a phone company (ignoring routing/signaling vulnerabilities). A quick search brought up this article:

https://www.theregister.co.uk/2016/12/06/2fa_missed_warning/

Because the telephone companies are terrible about security and often highly disorganized internally. They are beyond stupidly susceptible to Social Engineering and any "passcodes" against giving away access do not stand in the face of stupid customers and the need for customer service to satisfy them.

Your number can easily be stolen or redirected to get and sometimes send SMS from/to your number. Your cell phone account is the linchpin for a very extensive identity theft attack.

In their defense, being able to successfully identify a customer is who they say they are is a difficult problem that is only compounded when you might only speak to a customer as infrequently as every few years. 2F devices and codes can be lost. Passwords and pins can be forgotten. Answers to security questions can change. Have you ever tried to access your own account with a company like this without this data? There are few things more frustrating than being locked out of your account because you can't recall what you said your favorite movie was in 2012. Throw in the low odds of actually being targeted in a social engineering attack and companies optimize for customer satisfaction and convenience over security.

Blaming companies for responding to that incentives isn't going to accomplish anything. The way to fix things is to change the incentives by either increasing the punishment for falling for social engineering or create a system that makes it easier to remotely identify people.

This seems to indicate a level of sophistication behind traditional hacking skills. How did they get the phone number to know which carrier to contact to socially engineer?

Also, I am not sure I understand:

> we suspect weaknesses inherent to SMS-based 2FA to be the root cause of this incident

It seems that optaining employee login credentials was the root cause, and bypassing 2FA was the second hurdle but not the root cause.

You don't need to know the carrier, just the number. Talk to a carrier in the country and ask to port "your" number to a new plan. Most salespeople would have no problem ignoring security for a sale.

1. It's too easy to get a duplicate sim card

2. MITM for SMS is not hard if you can get close and requires <$500 in hardware

Cellphone accounts can be readily compromised via social engineering (aka tricking the CSR into changing things).

Here's a pretty hilarious and effective example where a crying baby background was used: https://www.youtube.com/watch?v=lc7scxvKQOo

Here is a good example of an attack against a system secured by SMS based 2FA: https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoi...

SS7 attacks.

In May 2017, O2 Telefónica, a German mobile service provider, confirmed that cybercriminals had exploited SS7 vulnerabilities to bypass two-factor authentication (2FA) to make unauthorized withdrawals from users' bank accounts. The criminals first installed malware on people's computers, allowing them to steal online banking users' account credentials and phone numbers. Then the attackers purchased access to a fake telecom provider and set up redirects from the victims' phone numbers to lines controlled by them.

https://en.wikipedia.org/wiki/Signalling_System_No._7

If that's what Reddit's security team was thinking by mid-2018, then Reddit security is in bad shape. NIST recommended the deprecation of SMS 2FA two years ago.

When NIST recommends the deprecation of a protocol you know you should've already gotten rid of it five years earlier, not keep it around for another five years.

The sooner more companies start supporting U2F and WebAuthn, the sooner more people will start buying and using hardware security keys.

I don't think it was up to Reddit. Some providers offer no way to do MFA without mandatory SMS involvement in some way -- either primary delivery is by SMS or you can "reset" / get back up codes via SMS.

Looking at you, LinkedIn.

Microsoft has been lax on this.

Many major banks do that too.

I've been interested in enabling MFA on my google account, but with no obvious way to bypass/disable SMS, I don't even bother.

Look at step 18 in this guide: https://techsolidarity.org/resources/security_key_gmail.htm

Because of cases like this, it's also the admin's responsibility to have their wireless provider put a security pin and a Do Not Port order on their account. Sometimes reps will ignore this and port people's accounts anyway, but it's still negligent not take this precaution.

Phone company reps are notorious for ignoring any and all such notes on accounts, we can't know for sure if Reddit had this in place but it probably wouldn't be much of a hurdle

It does sound like they used TOTP when possible but in some instances only SMS was available. My issue is that they seem to act surprised that SMS is so broken. I have trouble believing that any admins of a site that large have missed the various security alerts and news articles about hacked accounts, lost cryptocurrency, etc.

You don't even need those. TOTP is perfectly acceptable. It's simple, it's offline, it's free. It's a weekend project. Two functions and an extra column in a database. No hacking on clients, no implementing protocols, no buying hardware.

Implementing TOTP: https://www.serverstack.com/blog/2013/02/21/implementing-tot...

My opinion is hardware tokens are a joke for average user security. If I can't even keep my phone around to use TOTP, I'm sure as hell not going to keep track of my U2F token.

U2F is superior to TOTP because it's much harder to phish, and phishing is one of the two most serious attack vectors most teams face (the other being email attachments). Everyone that does U2F seriously also does TOTP, and doing both is the best option.

But yes, TOTP is a good start; the minimum that every serious team should have for its own personnel now.

U2F is pretty cool, but it's also a bit over-complicated. Specifically, I don't think we need USB or NFC.

A client (or an extension) could generate a QR code which embeds a signed request from the server (SRS) along with a signed request from the client using a key it generates just for this server (CRS). The user scans this QR, the user's phone app recognizes the SRS+CRS, and spits out a token or QR.

The phisher might be able to mitm the SRS, but they can't know what the CRS is, so they can't generate a fake QR that will validate on the client app. So with no special hardware, we generate a one-time token that [as long as they can't mess with browser window pop-ups or some other nonsense] can't be phished. (I'm excluding malware because we all know it's game over by that point)

Or we can just implement U2F, which was designed specifically based on experiences people had with TOTP phishing. There are software U2F tokens if you nerd-fussy about this stuff.

> If I can't even keep my phone around to use TOTP, I'm sure as hell not going to keep track of my U2F token.

You effectively can't implement U2F without TOTP, because otherwise when people lose their U2F dongle they'll be locked out of the site. For any given site you should turn on TOTP before activating U2F, but then store the TOTP secret somewhere secure and don't actually use it.

Has anyone leaked this? I'm more interested in unlocking my eponymous account I created 13 years ago then promptly lost access to without an email attached :(

How would that help you? Brute force a bunch of your old passwords?

There are a couple of comments on the linked thread suggesting that someone may be using it (scam emails containing people's old reddit passwords).

I thought I had heard that Reddit was using a non-salted or non-hashed password in the early days?

They probably deleted those backups when they realized how that was bad.

>"Can you txt me the old mysql root pw to the reddit DB? Need to check something, thanks - Alexis."

That was about 6 months before the stolen backup (December 2006): https://www.reddit.com/r/reddit.com/comments/usqe/reddits_st...

Reply on news.ycombinator.com