Far-Right Platform Gab Has Been Hacked—Including Private Data
WIRED reached out to Gab for comment Friday, offering to share what we'd learned about the nature of the site's data breach. The company's CEO, Andrew Torba, responded in a public statement on the company's blog that "reporters, who write for a publication that has written many hit pieces on Gab in the past, are in direct contact with the hacker and are essentially assisting the hacker in his efforts to smear our business and hurt you, our users." (WIRED has had no direct contact with the hackers, to our knowledge, only DDoSecrets.)
Responding to WIRED's mention of a SQL injection vulnerability, Torba's initial statement noted that “we were aware of a vulnerability in this area and patched it last week. We are also proceeding to undertake a full security audit.” The post went on to state that Gab doesn't collect personally identifiable information from its users such as telephone numbers, Social Security numbers, birth dates, or health and financial information. “DMs were only live for a few weeks and are not currently a feature supported by the site, so if a breach has in fact occurred in that domain we expect the number of affected accounts to be low,” Torba added. “As we learn more about this alleged breach, we will notify the community publicly with our findings as required by law.”
Torba did not confirm that a security breach had occurred in his Friday statement. But in a follow-up on Sunday, Torba used a transphobic slur to insult the hackers "attacking" the site and added that both his and Donald Trump's accounts had been "compromised." (DDoSecrets was careful to note to WIRED that it has not attempted to crack any of the hashed passwords or tested any of the plaintext passwords in the hacked data. WIRED hasn't either.)
“The entire company is all hands investigating what happened and working to trace and patch the problem,” Torba wrote Sunday.
Gab is the second far-right social media site to be deeply hacked in as many months. Following the Capitol Hill riot in January, other hacktivists used a simple security flaw in the bustling social media site Parler to download all of its public contents, including the location data embedded in every photo and video Parler users had posted. That Parler data, which placed several users at Capitol Hill on January 6, was preserved by the Internet Archive and also made available by DDoSecrets.
When Amazon booted Parler from its hosting service in January, many of the site's users flocked to Gab. But until now, hacktivists have had a hard time downloading public Gab posts as they did with Parler, says Max Aliapoulios, a graduate researcher at the New York University Center for Cybersecurity, with whom DDoSecrets has shared a copy of the hacked Gab data. Due mostly to Gab's instability and frequent downtime, Aliapoulios found that he couldn't easily use an automated tool to scrape the site.
Aliapoulios, cocreator of the Social Media Analysis Toolkit, a project that analyzes online communities, argues that the leak of non-private data from Gab will serve a public interest. "This is all of Gab, and we didn't have to even run a crawler to get it," Aliapoulios says.
The data, he says, could offer a window into how users migrate from one service to another when facing bans or deplatforming and could even serve to help build tools to keep Gab's hate speech and disinformation from spreading to other sites. "There's so much hate, harassment, racism, neo-Nazism that occurs on a site like that," Aliapoulios says, "that having a record of that could help develop ways to automatically detect that type of content so that other places that don't allow it can remove it."
The Gab hack is just the latest in a recent string of apparent "hacktivist" breaches, many of which have ended with DDoSecrets publishing reams of stolen data, or making it privately available to journalists and researchers. DDoSecrets has also recently released hundreds of gigabytes of information a hacker took from corporations in Myanmar following the military coup there earlier this month. Over the summer, DDoSecrets rose to prominence with a massive leak of law enforcement data stolen by a hacker associated with Anonymous, which DDoSecrets dubbed BlueLeaks. And last month it controversially began publishing collections of corporate data stolen and leaked by ransomware hackers after their victims refused to to pay.
Gloss