Gab, a social network that's home to many Trump supporters, has experienced another data breach—apparently from the same hacker who stole 70GB of data from the site.
On Monday, a hacker known as "JaXpArO" hijacked the Gab account for the site’s founder, Andrew Torba, and posted a note claiming the social network was still compromised. "Dear Andrew, if you value transparency so much why do you keep lying to your despicable users?” JaXpArO wrote. “It was so easy to hack you maybe I'm not the first?”
The incident underscores how JaXpArO may have stolen more than just 70GB from the social network. Last month, the hacker shared the stolen data with a Wikileaks-style group called Distributed Denial of Secrets in an effort to expose the right-wing users on Gab. However, in JaXpArO’s note on Monday, the hacker mentions also looting 50,000 emails, 7,000 passwords, and 831 “verification documents,” which have not been publicly leaked.
JaXpArO alludes to trying to ransom the stolen data from Gab for 8 bitcoins (US$432,000). In response, the social network briefly shut down on Monday in order to investigate the breach.
Gab previously claimed it patched the vulnerability that allowed JaXpArO to steal data from the site. But apparently the company forgot to secure the OAuth tokens, an access control system for Gab user accounts, allowing the hacker to pull off Monday’s hijacking.
“The attacker who stole data from Gab harvested OAuth2 bearer tokens during their initial attack. Though their ability to harvest new tokens was patched, we did not clear all tokens related to the original attack,” Torba wrote in a post on Monday. “By reusing these old tokens, the attacker was able to post 177 statuses in an 8-minute period today. We have not independently verified the information that the hacker posted is authentic.
“We have been able to confirm it was not a new attack, have cleared all compromised tokens, and are requiring users to log in again,” he added.
Still, the breach won't inspire much confidence in Gab’s IT security. Last month, Torba tried to downplay the 70GB data heist. But then days later, he used a transphobic slur and claimed “demon hackers” had attacked the site as news of the breach came to light.
According to Distributed Denial of Secrets, JaXpArO stole data from Gab through a SQL injection bug to siphon data from its databases. Whether JaXpArO has uncovered other vulnerabilities in the social network remains unclear. But to address the threat, Gab has hired an unnamed IT security team to investigate the breach.