Reddit has suffered a data breach compromising usernames, passwords and email addresses of groups of users, the site has confirmed.

While the size of the breach has yet to be clarified, Reddit said two data sets had been accessed by hackers, including one from 2007 containing account details and all public and private posts between 2005 and May 2007.

The second data store included logs and databases linked to Reddit’s daily digest emails, which was accessed between 3 and 17 June this year. The data includes usernames and email addresses linked to those accounts.

Jake Moore, security specialist at ESET, said: “Reddit is one of the world’s biggest websites so a hack of any data at this level is quite a feat.”

Reddit said the breach was discovered on 19 June following the attack happening four days prior. The hackers broke in using compromised employee accounts that were protected using SMS two-factor authentication.

The site said it was messaging affected users. Reddit chief technology officer Christopher Slowe said: “If your account credentials were affected and there’s a chance the credentials relate to the password you’re currently using on Reddit, we’ll make you reset your Reddit account password.”

“Whether or not Reddit prompts you to change your password, think about whether you still use the password you used on Reddit 11 years ago on any other sites today.

“If your email address was affected, think about whether there’s anything on your Reddit account that you wouldn’t want associated back to that address.”
SMS-based two-factor authentication broken

Reddit uses the common SMS-based two-factor authentication to protect its employee accounts, requiring a one-time passcode to be entered alongside a username and password.

However, Reddit said hackers had intercepted those text messages.

Keith Graham, chief technology officer for SecureAuth + Core Security, said: “While SMS-based authentication is popular and much more secure than password alone, it’s widely known to be vulnerable to cybercriminals who have hacked many celebrities using this method.

Graham explained that cybercriminals are capable of gaining access to a phone number to which an SMS two-factor code is sent. He said: “For example, a cybercriminal would simply need to give a wireless provider an address, last 4 digits of a social security number and perhaps a credit card to transfer a phone number.

“This is exactly the type of data that is widely available on the dark web thanks to large database breaches like Equifax.”

Source: The Guardian