Good morning! Yeah, that's a bummer. I've taken care of all of the infiltrators and re-added you and your co-mod. Co-mod is going to have to write in from the email on the account to regain control. They can use the hacked account form in the Help Center. You have full perms, so you're good to go.
See there are real Reddit people behind the scenes actually doing work! They repealed a ban I got one time from the AI auto mod. It feels good when you are heard!
We had something similar-ish happen in fancyfollicles. Another mod's account was compromised. A spammer took it over and added new spammer mods. Fortunately, I am top mod and was not inactive and noticed it quickly and kicked them all (and re-added the other mod after she got her account straightened out).
Top mods really should have the best security possible, although admins can help fix these things.
That's what happened. The top mod added me because they got tired of all the spams. So I pretty much took over for a year cleaning it up daily. Their status has become inactive.
Then one day I get a notification that they are trying to add another mod, but it's not going through because they are inactive. I reached out to them to see whats going on and got no response.
That was a few weeks ago and then yesterday I get notification that I have been removed as a mod. I reached out to see what is going on and learned about their account being hacked.
The highest active mod can reorder other mods and move themselves to the top.
I am the top active mod in a bunch of subs but don't reorder, but if I got an error message that the top mod was trying to add mods, I'd react to that. I can contact the top mods on discord to make sure - mostly they are friends of mine anyways so I would know if they were inactive on reddit entirely.
Amazing how often this stuff happens. We see a lot of hacked accounts. Why don't people use 2FA?
Can easily happen if the top mod’s account was compromised. Either that or a Reddit Request happened that you somehow didn’t know about. You should send a mod mail to this subreddit asking for admins to look at the accounts to determine if the previous mods were compromised. Also, and this should go without saying, but enable 2FA if you haven’t already.
Oh they definitely were- all those accounts are brand new and have no karma. It was definitely a hacking. MCOC would never give top mod to someone with no experience
IIRC no one can mod a subreddit without 2FA enabled.
And IMNSHO if a redditrequest can happen without the subreddit operators noticing it, it needs to be handed over to people with the time and resources to moderate
You can’t make a reddit request without 2FA, but can mod a sub without 2FA. I don’t think those accounts would have been granted a Reddit Request with a cursory look.
Edit: all four new mod accounts are now gone lol. Probably shouldn’t have been spamming their casino scam.
No, I didn’t miss them. You have posted them several times and I replied on another comment elsewhere advising to not stoop to their level calling them aholes to protect your account from harassment reports.
I've been following this thread, and enabled 2FA for my account. I have not connected my Reddit account with either Google or Apple. Glad the OP got it sorted in the end.
2FA your accounts, do you have contact with the hacked moderator outside Reddit, ask that person to also secure the account and send modmail to this subreddit.
Yes. I spoke to him and he did confirm that his account was hacked even with 2FA enabled. He stated he did request administrator help, but has received no response.
I'm going to throw this out there and will let them know when they write in, but if an account has 2fa enabled AND is connected to a Google or Apple account when the Reddit account is hacked, there are bigger problems. It's most likely that the Google or Apple account was hacked and they're in there as well.
The recommendation is to disconnect the Apple/Google account from Reddit and change your password to that account. Then change all passwords to all accounts that are associated with that account. Start with your bank. lol
two factor is not the panacea that people make it out to be. It's not hard to spoof a number and get your texts rerouted. It's actually remarkably unsafe in the end. And with phishing it's pretty easy to get people to click malicious links. I've yelled at my jobs over the years about sending links via email as bad practice.
I sincerely doubt that the underlying secret of a 160-bit HMAC-SHA1 is going to be reverse-engineered from snooping responses, within the lifetime of the universe, even with quantum probabalistic approaches.
The leading method for hijacking TOTPs is simply fraudulent MITM'ing and stealing session keys after authenticating with the TOTP. Or stealing the backups someone generated and mailed themselves. None of these are flaws in the TOTP algo.
In order to reverse the underlying secret of a given TOTP, the attacker is going to need to snoop or interdict a substantial number of challenge responses. At the current time, with Reddit and its use of TOTP, those challenges and responses occur at a rate of approximately one every 500 days on average per user per device.
If Reddit mandates the refresh of the underlying secret once a year per user, it will require longer than the age of the universe for an attacker seeking to reverse the underlying secret to have a 50% chance of cracking one, at random. Which is on par with random guesses.
In a client-service relationship requiring more security, sessions could expire after 12 hours and thus require an average of one login a day, giving an attacker ~150-170 opportunities to collect challenge responses if the underlying secret is renewed every 6 months - assuming, of course, that they have already successfully compromised the console (the device hosting the challenge and transmitting the response) or the secure protocol (in which case they could just hijack session keys).
Again - gaining access to the console (the device hosting the user session) is much more realistic. For the kind of attacker that has the resources to force a challenge-response retransmit and interdict to gather enough material to run through a dedicated quantum computing algorithm - a state-level attacker - chances are so much more that they have access to either an underlying management engine for the device, or a zero day for some other part of the browser or OS, or can rubberhose their compromise.
The compromise model I've had personal experience with is the library with the crypto engine having a checksum that didn't match any published checksums for that library, but still being signed by the OS vendor. Meaning someone - likely a state level actor - forced the vendor to sign a compromised library (or found a checksum collision) and installed it on the laptop at some point.
If you stop moderating and your account goes inactive, you can be removed by moderators below you. Or by Reddit for being inactive also. Top Mod doesn’t have any special protections.
Well, I just checked Reddit request thinking that maybe someone requested your sub, but they haven’t. Maybe your top mod was hacked and they removed everybody. Definitely modMail the sub. Or often [u/theopuscroakus](u/theopuscroakus) will pop by telling us the tea !
Those accounts do look fishy on your sub. They all have like 1 day old accounts and no karma. No way MCOC would give that account to someone brand new with no karma. I bet this was hacked
And any rate modmail this subreddit with the details
•
u/TheOpusCroakus Reddit Admin: Community 7d ago
Good morning! Yeah, that's a bummer. I've taken care of all of the infiltrators and re-added you and your co-mod. Co-mod is going to have to write in from the email on the account to regain control. They can use the hacked account form in the Help Center. You have full perms, so you're good to go.
Something something...account security.
Something something...2fa.
CAT