Reddit Hit By Phishing Attack, Source Code Stolen

Reddit endured a cyber-attack just after its inner techniques have been breached on February 05 owing to a “sophisticated” and “highly-targeted” phishing attack that led to worker credential compromise.

“The attacker despatched out plausible-sounding prompts pointing staff members to a internet site that cloned the conduct of our intranet gateway in an try to steal credentials and second-component tokens,” the business wrote on Thursday.

“After properly obtaining a single employee’s credentials, the attacker acquired obtain to some internal docs, code, as effectively as some inside dashboards and business enterprise devices.”

Having said that, Reddit claimed there was “no indication” of a breach of the company’s primary manufacturing methods, the place most of its facts is saved.

“Exposure incorporated minimal make contact with details for (at present hundreds of) firm contacts and personnel (current and previous), as very well as minimal advertiser data,” reads the disclosure.

“Based on many times of the initial investigation by security, engineering, and details science (and pals!), we have no proof to suggest that any of your non-general public knowledge has been accessed or that Reddit’s facts has been posted or distributed on the net.”

In accordance to CyberSmart CEO Jamie Akhtar, the breach is a excellent case in point of the maxim ‘your personnel are your most beneficial security asset.’

“Despite Reddit acquiring superb technical security controls in place, cyber-criminals were ready to breach its defenses only by targeting its personnel,” Akhtar told Infosecurity in an email.

“Training can support your persons far better figure out and realize the threats they confront. And, extra importantly, master how to avoid them in the very first area.”

Erfan Shadabi, a cybersecurity skilled with knowledge security experts comforte AG, echoed Akhtar’s stage, introducing that a culture of details security and privacy will have to be sponsored from the top down.

“[This], alongside with a corporate culture that encourages workforce to examine requests for sensitive details no make a difference how a great deal time it requires, can change the tide on this at any time-present pattern of phishing assaults.”

The Reddit breach comes months following security corporation Cerby released a report suggesting that the security shortcomings of Reddit and other social media could guide to disinformation.

Some parts of this article are sourced from:
www.infosecurity-journal.com