Reddit massive hack: hackers defaced channels with pro-Trump messages

Reddit suffered a massive hack, threat actors compromised tens of Reddit channels and defaced them showing messages in support of Donald Trump’s campaign.

Reddit suffered a massive hack, threat actors defaced tens of channel to display messages in support of Donald Trump’s reelection campaign.

At the time of writing, the massive hack is still ongoing and Reddit’s security team is working to restore the operations.

Below a list containing some of the impacted subreddits, some of them having tens of millions of members:

r/NFLr/CFB (Canadian Football League)r/TPB (The Pirate Bay’s Reddit channel)r/BlackMirror (TV show)/r/Buffy (TV show)r/Avengers (Movie franchise)r/Vancouver (city)r/Dallas (city)r/Plano (city)r/Japanr/Gorillaz (music band)r/Podcasts/r/Disneylandr/49ers (NFL team)/r/BostonCeltics (NBA team)r/Leafs (Toronto Mapple Leafs)/r/EDM (electronic dance music channel)/r/Foodr/Beerr/Rentingr/Lockpickingr/Subaru (car maker)r/freefolk (Game of Thrones fan channel)r/Spacer/ISSr/DestinyTheGame (video game)r/LawSchoolr/StartledCatsr/TheDailyZeitgeistr/Supernatural/r/Naruto/r/RupaulsDragRacer/GREr/GMATr/greatbritishbakeoffr/11foot8r/truecrimepodcastsr/comedyheavenr/weddingplanningr/Chadsriseupr/BertStripsr/KingkillerChronicle (book series)r/PoliticalDiscussionr/MadLadsr/DNDMemesr/woodpaneledr/telescopesr/WeAreTheMusicMakersr/DeTrashedr/Samurai8r/3amjokesr/ANGELr/PhotoshopBattlesr/Animemesr/comedyheaven/r/awwducationalr/gamemusicr/hentaimemesr/ShitAmericansSayr/ShitPostCrusadersr/SweatyPalmsr/Locklotr/BadHistoryr/CrewsCrew/r/ListenToThisr/PokemonGOBattleLeaguer/FacingTheirParentingr/TwoSentenceHorrorr/BookSuggestionsr/FreezingFuckingCold/r/woof_irlr/BurningAsFuckr/ImagineThisViewr/AnotherClosetAtheistr/CasualTodayILearnedr/ShowerBeerr/TookTooMuchr/DallasProtests/r/BannedFromClubPenguinr/creepyPMsr/RedditDayOfr/AquaticAsFuckr/HeavyFuckingWind/r/BlackPeopleTwitterr/HuskersRiskr/Fireteams/r/LuxuryLifeHabitsr/IRLEasterEggsr/nonononor/nonononoyesr/ThatsInsane

According to Reddit, the hacker compromised several subreddit moderator accounts.

Owners of the channel that are facing security issues could report problems in this Reddit ModSupport thread, meantime they are recommended to enable two-factor authentication (2FA) on their accounts and to change their passwords.

Indicators of compromise for the Reddit moderator accounts are:

• moderator received email notification that the password and/or email address on your account changed but you didn’t request changes
• moderator notice authorized apps on your profile that you don’t recognize
• moderator notice unusual IP history on your account activity page
• moderator see votes, posts, comments, or moderation actions that you don’t remember making, or private messages that you don’t remember sending

One of the moderators who had their account compromised published the details of the actions performed by attackers on his behalf.

“Help! I’ve been hacked by some bizarre pro-trump bot! It wrecked my subreddit’s style sheet, deleted all mods below me, updated the wiki… I’m in way over my head. What can I do? PSA: Change your passwords and enable 2-factor authentication!” reads the title of the discussion.

Once the attacker has taken the control of the mod’s account, he changed his subrreddit’s CSS stylesheet, deleted all mods with fewer permissions than him, and changed the community’s wiki.

Finally, the hacker published the message: “We Stand With Donal Trump #MIGA2020.”

The Twitter account https://twitter.com/advanceHCAjobs claimed responsibility for the massive Reddit hack, but currently, the account was suspended. While the hackers were targeting subreddits, they asking Twitter users to vote on them.

Source BleepingComputer

In June, Reddit has banned a channel of President Trump supporters, r/The_Donald, after he received reports of harassment, bullying, and threats of violence.

Pierluigi Paganini

(SecurityAffairs – hacking, Trump)