70TB of Parler users’ messages, videos, and posts leaked by security researchers
1–10 of 1001 posts
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#2Discussion of how it was done here:
https://www.reddit.com/r/ParlerWatch/comments/kuqvs3/all_par...
Edit: this Reddit post appears to be inaccurate. More details here: https://news.ycombinator.com/item?id=25725268
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#3Sounds like Twillo was actively helping hackers "That allowed them to see which users had moderator rights and this in turn allowed them to reset passwords of existing users with simple “forgot password” function. Since Twilio no longer authenticated emails, hackers were able to access admin accounts with ease."
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#4This sounds like an incredible fuckup by Twilio. If it's true that their authentication verification was the entrypoint, they could be liable for leaking an enormous amount of personal information.
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#5Discussion of how it was done here: https://www.reddit.com/r/ParlerWatch/comments/kuqvs3/all_par... Edit: this Reddit post appears to be inaccurate. More details here: https://news.ycombinator.com/item?id=25725268
The linked post celebrates this saying they can share this data with law enforcement, but is it legal for them to pursue cases based on the evidence found in stolen data?
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#6Discussion of how it was done here: https://www.reddit.com/r/ParlerWatch/comments/kuqvs3/all_par... Edit: this Reddit post appears to be inaccurate. More details here: https://news.ycombinator.com/item?id=25725268
The linked post celebrates this saying they can share this data with law enforcement, but is it legal for them to pursue cases based on the evidence found in stolen data?
Yes.
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#7Discussion of how it was done here: https://www.reddit.com/r/ParlerWatch/comments/kuqvs3/all_par... Edit: this Reddit post appears to be inaccurate. More details here: https://news.ycombinator.com/item?id=25725268
The linked post celebrates this saying they can share this data with law enforcement, but is it legal for them to pursue cases based on the evidence found in stolen data?
https://www.nolo.com/legal-encyclopedia/searches-private-cit...
> But, in some ways, there’s really no such thing as an “illegal” search by a private citizen, at least in the sense that police searches can be illegal: Regardless of issues like lack of probable cause, evidence found by private citizens acting on their own is usually admissible in court. That’s true even if the private citizen committed a crime like trespass or theft to accomplish the search.
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#8This story truly terrifies me: my team owns my company's sign up page. (I speak for myself and not them, of course).
Sounds like Parler, fearing that their OTP provider might go down, decided to fail-open, ie: if the dependency throws an exception, presume there's something wrong with the dependency and that the code provided is acceptable. It never occurred to them that the dependency could be down permanently, or that malicious actors[0] would be able to realize it and exploit to quickly.
Lesson learned: do not fail open where security matters, where authentication matters. Failing closed prevents new users/customers from signing up, but it protects your existing users/customers.
[0]From a security standpoint, these are malicious actors. I would also probably buy said malicious actors a beer if I met them, accompanied by a high five.
Edit: this is a hypothesis of course. Maybe the bug was somewhere else in the system- it could be in Twilio's provided integration library where the fail-open occurred.
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#9Sounds like Twillo was actively helping hackers "That allowed them to see which users had moderator rights and this in turn allowed them to reset passwords of existing users with simple “forgot password” function. Since Twilio no longer authenticated emails, hackers were able to access admin accounts with ease."
Maybe Parler should have done their due diligence and planned for if their email verification service stopped working.
The logic doesn't even make sense. Twilio goes down for them and then they just allow anyone access to user accounts.
Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers
#10All of this is surely going to end well.