Salma Typhii
A
I get that a breach is never good just like breaks in infection control are never good, but how much, realistically, can someone do with what data Spoutible has of mine? Yay, you found my throw-down email and phone number 🤷🏻‍♀️
Isa-Lee Wolf @IsaLeeWolf
So I was on the bad site for a second, and found this.

And now I am torn between pointing out that Christopher didn't write it, I did, and not stepping my toe in the fetid waters of twitter.
10:41 AM - Feb 06, 2024
10:51 AM - Feb 06, 2024
Avatar Avatar Avatar
0
45
13
Isa-Lee Wolf
A
In response to Salma Typhii.
EXACTLY!!

And I don't think anyone was actually hacked, I haven't seen anything confirming it.
11:06 AM - Feb 06, 2024
2
11
Dan Nguyen
A
In response to Isa-Lee Wolf.
The API leaked everyone’s password reset tokens — allowing an attacker to silently change the password (since Spoutible doesn’t send an email about the change) and log into any account. If we’re lucky, no one was compromised but it’s too early to tell
11:51 AM - Feb 06, 2024
1
0
Isa-Lee Wolf
A
In response to Dan Nguyen.
1. The operative word here is COULD. We have no evidence anyone DID.
2. The information was ENCRYPTED, a point Hunt bemused over. No DECRYPTED passwords or tokens were scraped (they weren't leaked, it took effort to retrieve them).
3. Password and authentication reset after the patch fixed it.
12:04 PM - Feb 06, 2024
1
2
Dan Nguyen
A
In response to Isa-Lee Wolf.
The leaked passwords were encrypted. But most of the data fields in the API were not, including the token that is used for generating a p/w reset page: an attacker doesn't need to know your password when they can just reset it and login without you knowing.

The API and tokens were fixed, but...
12:10 PM - Feb 06, 2024
2
1
Isa-Lee Wolf
A
In response to Dan Nguyen.
The token used for 2FA WAS ENCRYPTED as he used a program to decrypt it.

Did you miss that part? Not understand it?

Both passwords and the token would require decryption and again there IS NO EVIDENCE THUS FAR ANYONE ACTUALLY DID.

And his example was using a very hackable password.
12:22 PM - Feb 06, 2024
1
0
Dan Nguyen
A
Yes I read and understood it.

Did you stop reading there? Because in the very next section Hunt points out how an attacker didn't need to decrypt the passwords OR the 2FA token, because they could just plug in the password reset token and silently reset anyone's password
In response to Isa-Lee Wolf.
12:49 PM - Feb 06, 2024
1
0
Isa-Lee Wolf
A
In response to Dan Nguyen.
Now I will grant you Hunt is not the clearest or best writer I've ever read, but the password reset was AFTER he gained access to the account he setup.

In any case, what is your point? That's all fixed.
12:56 PM - Feb 06, 2024
0
0

 

{{ notificationModalContent }} {{ promptModalMessage }}