Buffalo Mass Shooting Victims' Families Sue Meta, Reddit, Amazon

The families of victims of a mass shooting in Buffalo are challenging the platforms they believe led the attacker to carry out a racist massacre...

Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia

Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks. "Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links,...

Reddit: Huge amount of Subdomains Takeovers at Reddit.com

Vulnerability description not provided...

Reddit: [accounts.reddit.com] Redirect parameter allows for XSS

The dest parameter in accounts.reddit.com was vulnerable to Cross-Site Scripting XSS attacks, allowing an attacker to execute malicious code and steal user cookies by tricking them into logging in. The vulnerability was exploitable both for logged-in and logged-out users...

Reddit: Blind SSRF to internal services in matrix preview_link API

A vulnerability was found in the previewlink functionality of Matrix software used in Reddit's new chat system. The endpoint allowed for partially blind SSRF, enabling attackers to send GET requests and exfiltrate data about internal services. This could potentially lead to service enumeration an...

Google Pay accidentally handed out free money, bug now fixed

Days ago, several Google Pay users in the US received some unexpected cashback from Google, congratulating them "for dogfooding the Google Pay Remittance experience". Confused and a tad happy, some looked to Twitter for answers, while others aired their experiences on the /r/googlepay/ Reddit pag...

RedditC2 - Abusing Reddit API To Host The C2 Traffic, Since Most Of The Blue-Team Members Use Reddit, It Might Be A Great Way To Make The Traffic Look Legit

Abusing Reddit API to host the C2 traffic, since most of the blue-team members use Reddit, it might be a great way to make the traffic look legit.  Disclaimer: Use of this project is for Educational/Testing purposes only. Using it on unauthorised machines is strictly forbidden. If somebody is...

SUSE CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

North Korean Hackers Are Attacking US Hospitals

Plus: Deepfake disinformation spotted in the wild, Android privacy problems in China, Reddit gets phished, and more...

Reddit breached, here's what you need to know

On Thursday, February 9, 2023, Reddit reported that it had experienced a security incident as a result of an employee being phished. What happened? According to Reddit, it "became aware of a sophisticated phishing campaign" late on February 5, 2023, that attempted to steal credentials and...

Reddit Hacked After Employee Bites on Phishing Scam

By Deeba Ahmed According to Reddit, the breach took place after one of its employees fell for a phishing scam email sent through a malicious fake website. This is a post from HackRead.com Read the original post: Reddit Hacked After Employee Bites on Phishing Scam...

RedditOnRails 访问控制错误漏洞

RedditOnRails is a Reddit-like site built on Ruby on Rails. An access control error vulnerability exists in RedditOnRails, which stems from incorrect access control...

Reddit: oauth misconfigration lead to account takeover

Vulnerability description not provided...

Reddit: api keys leaked

Summary: Disclosure of valid private keys may lead to unauthorized access to any systems that use them for authentication. Verify whether any keys disclosed are actually valid, and whether their disclosure within the application is appropriate Impact: Disclosure of valid private keys may lead to...

Reddit: read and message other user's messages

Vulnerability description not provided...

A week in security (August 22 - August 28)

Last week on Malwarebytes Labs: Cryptojackers growing in numbers and sophistication CISA wants you to patch these actively exploited vulnerabilities before September 8 Reddit users crowdsourcing explicit images and identities Criminals socially engineer their way to bank details with fake arrest...

Reddit users crowdsourcing explicit images and identities

The BBC is warned of a large photograph trading ring which operated on popular group forum site Reddit. These warnings are in relation to stolen nude photographs and other content shared without permission. In this case, even non-explicit photos are being posted alongside frequently degrading and...

Reddit: IDOR allows an attacker to modify the links of any user

Hi team! I found an IDOR which allows to modify the links of any user. Users can put their custom links or social media links on their profile, ex: F1855366 To reproduce this: - Replicate the following request by replacing it with your own authentication headers: You must also put in the body of...

Reddit: Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability

Summary: There's no check if the user is moderator of the particular subreddit or not while trying to access the mod logs via gql.reddit.com by using operation id. You can change the parameter subredditName to any target subreddit name which is public or restricted and get access to mod logs of...

Reddit: Reddit talk promotion offers don't expire, allowing users to accept them after being demoted

Description: When promoting a user to a speaker/host, an offerId is created which can be accepted by the user. However, after accepting them the offerIds don't expire. This means that after the user is demoted back to a listener, they can still use the offerIds to go back to their previous promot...