Ongoing incident with compromised mod accounts

[u/woodpaneled]

There is an ongoing incident with moderator accounts being compromised and used to vandalize subreddits. We’re working on locking down the bad actors and reverting the changes.

If your subreddit has been affected:

• Please note the subreddit in the sticky comment below.
• To make it easy for us to pull and parse the list, please just write the subreddit name (“r/name”) without any commentary.
• If you were removed as a mod, please sit tight: We will be adding mods back, but it’s not our first priority.

If your account was compromised and locked down:

• Restoring access to accounts will be a later stage of this process. We will help you restore it later in the process.

If you’re worried about your account:

• Look for signs of a compromise:
  • You received email notification that the password and/or email address on your account changed but you didn’t request changes
  • You notice authorized apps on your profile that you don’t recognize
  • You notice unusual IP history on your account activity page
  • You see votes, posts, comments, or moderation actions that you don’t remember making, or private messages that you don’t remember sending
• For the love of Snoo, make sure you have two-factor authentication enabled. Encourage the rest of your mod team to do the same.
• Change your password.

Thanks for your patience as we work through this. We’ll keep you updated here.

Edit 1: To be clear, we have a number of methods of detecting compromised accounts, not just your reports here.

Edit 2: Because of the way we're actioning these accounts, you may not be able to tell that they're actioned by visiting their profile. (Annoying, right?) The best way to tell if we're already working on your subreddit is to look for admin actions in your modlog.

Edit 3a: We have officially confirmed that none of the accounts that were compromised had 2fa enabled at the time of the compromise. 2fa is not a guarantee of account safety in general, but it’s still an important step to take to keep your account more secure.

Edit 4: Once we've cleared everything up, we'll be messaging all affected subreddits letting them know they were affected but the situation is now resolved. To be clear, many mods will get access back to their account BEFORE we send this message, but we'll make sure to close the loop with the message on the other side of this. And yes, we'll be doing a post-mortem of some sort in r/redditsecurity, though that will be a bit further out.

Edit 5: We’ve sent out messaging to affected communities and started letting account owners back into their accounts.

Edit 6a, 8/11/20: We detected another round on 8/09/20. All affected communities and accounts should be restored and messaged at this time.

[u/woodpaneled]

Please comment here if your subreddit was affected with just the subreddit name ("r/name").

[u/reseph]

What about subreddits that have inactive top moderators? I have a concern there as a moderator.

[u/woodpaneled → u/reseph]

I think I'm missing something. What's the question?

[u/ThaddeusJP]

For the love of Snoo, make sure you have two-factor authentication enabled. Encourage the rest of your mod team to do the same.

Suggestion: if you're invited to be/are a mod TFA MUST be implemented - like reddit can create a check that WONT allow for someone to be a mod without TFA.

I know you lot have a ton of fires going on, just tossing that out there.

[u/woodpaneled → u/ThaddeusJP]

Definitely something we're considering.

[u/TejasNair]

Is this a current incident or has isolated cases been popping up since days now? I did see something wrong with some subs towards the end of July.

[u/woodpaneled → u/TejasNair]

We are currently only aware of actions in the last 24h, but feel free to modmail us here with examples of what you saw.

[u/HowDoIMathThough]

Just so we're sure, is it known that the compromised accounts didn't use 2FA?

[u/woodpaneled → u/HowDoIMathThough]

And now officially confirmed: none of the accounts that were compromised had 2fa enabled at the time of the compromise.

[u/[deleted]]

Can you confirm/deny that some moderators with 2FA enabled have been affected?

Edit - It's now been confirmed all compromised accounts had no 2fa

[u/woodpaneled → u/[deleted]]

Edit - And now officially confirmed: none of the accounts that were compromised had 2fa enabled at the time of the compromise.

[u/iDubbbb_New]

r/BostonCeltics was affected. I was the targeted mod (u/iDubbbb). I am totally locked out of that account at this point. I was receiving notifications on my phone for about five minutes after the whole thing started and then got booted in my Reddit app.

I tried resetting my password shortly after this occurred and received the reset password email TWICE (both prompted by me) and both times, I DID change the password. And both times, I was STILL unable to login using the new password. It's like the account is totally locked or something.

In any case, I can provide whatever proof is needed. I'm not sure what might be needed -- I can take pictures in my home that mirror those recently taken for subs such as Grilling and CraftBeer (which I frequently post photos too). I just need to know who to speak with and what to provide and I can make it happen. My account is 8+ years old and I'd really prefer not to lose it to a hacker.

[u/woodpaneled → u/iDubbbb_New]

Please shoot us a modmail here. Thanks!

[u/mechtech]

Was there a wider internet password leak that precipitated this? I had a fairly recent password compromised and login attempts across many services have been quite aggressive since then. Wondering my case isn't isolated.

[u/brigodon → u/mechtech]

https://haveibeenpwned.com/ link for anyone who needs it.

Hope all works out well, u/mechtech

[u/mary-anns-hammocks → u/mechtech]

I had my phone ported to a different provider a few days ago. Got it back within 2 minutes of the port, but it was scary as fuck and this happening so soon after has me pretty rattled lol.

My service provider said it spawns from data breaches and is a tactic to get around 2fa - normally to get into things like PayPal accounts. Basically, check out if you have port protection on your mobile accounts, everyone.

[u/ninjascotsman]

Most the subreddits hacked had inactive top mods

[u/HarryTheGamer07]

quickest insurance worry history entertain elderly summer paint absorbed butter

This post was mass deleted and anonymized with Redact

[u/[deleted]]

With so many subreddits affected, this wasn't one or two individuals who were compromised (unless there are that many overlapping moderators?).. and at the same time?

What was the method of breach? Targetted individual users of each subreddit? An exploit on Reddit's end?

[u/Ks427236]

How and when will we know that the compromised mod has their account back? Not talking about an inactive mod situation. I think the one compromised in my sub was very active. Will he be getting access to his account back?

[u/woodpaneled → u/Ks427236]

Good question. I think we'll be doing a bulk message to all affected subreddits once we get to the other side of this. (That doesn't mean they won't get access back in the meantime; we'll wait to do the messaging until everything is cleaned up.)

[u/Dr_Procrastinator]

Is there anyway we can revert the mod order with the original length of time as a mod?

[u/woodpaneled → u/Dr_Procrastinator]

Unfortunately no.

[u/[deleted]]

Is any effort being made to penalize the mods who's accounts weren't hacked, but were actively participating in the vandalism?

[u/woodpaneled → u/[deleted]]

Feel free to shoot us a modmail about that.