Security Advisory: Specialised Phishing Attack on Moderator Teams (CVE-RedditMods-001)

95  2019-10-19 by trappysaruh

41 comments

ID: T11008-BDEE93 Tactic: Initial Access Platform: Reddit Data Sources: Mail, Modmail CAPEC ID: CAPEC-16963 Version: 1.2a

Adversaries may breach or otherwise leverage mod organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Organizations often grant elevated access to second or third-party external mod connections in order to allow them to manage internal subreddits. Some examples of these relationships include powermods (e.g. gallowtitties), admins, and ban appeals. The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the modmail. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.

All forms of spearphishing are electronically delivered social engineering targeted at specific users, mods, or subreddits. In this scenario, adversaries send messages through mod mail. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake reddit accounts and message mods for potential opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious messages or bait through these services.

I don't have enough spoons to read this shit

I am a bot. Contact for questions

I feel the same way LPB, I feel the same way

keep yourselves safe

Is bardfinn cyberbulling reddit jannies now?

They really out here kys-posting

skrrt skrrt my heart hurt

Outlines:

  1. This Post - Outline

I am a bot for posting Outline.com links. github / Contact for info or issues

You're not even trying to be witty or anything, you're just circlejerking. How does it feel literally karma whoring, like, actually just being a human who cares enough to type multiple comments for no purpose except to draw a nearby majority's attention to the fact that you agree with them?

Snapshots:

  1. Security Advisory: Specialised Phis... - archive.org, archive.today

I am just a simple bot, *not** a moderator of this subreddit* | bot subreddit | contact the maintainers

I hope whoever is doing it is wildly successful in getting hundreds of jannies banned so they don't get their checks this week, oh wait they all do it free of charge, nothing is ever paid to them because they are willing to do it for free.

You were banned from /r/Drama because one or more of your comments or submissions in the subreddit violated Rule 2 of the subreddit -- they contained one or more instances of:

  • flamebait,
  • fallacies;
  • were hostile in tone or nature;

  • and -

  • were judged to be made in bad faith.

You may appeal this ban 72 hours from now.

To appeal this ban, you may reply to this in modmail.

In the body of the appeal, you must:

  • Note in the Title or Body of the appeal that it is a "Formal Ban Appeal";
  • Link to the content that you know or suspect to have prompted the ban;
  • Explain in full which of the subreddit rules and/or Reddit Content Policy the content violated;
  • Explain your plan to avoid violating the subreddit rules and/or the Reddit Content Policy in the future;
  • Apologise for the incident.

Appeals submitted without these five elements will not be considered. Responses which are not appeals may be reported to Reddit Administration as Violations of the Reddit Content Policy against Harassment.

B& fin-pilled.

Lmao

That sounds like the /r/AskTrumpSupporters rules.

Lmao I'm so happy you're back

If this person isn't receiving financial compensation for what may be the most pathetic thing I've witnessed on a site renown for such things, I don't think humanity deserves to survive.

I'm not even phased.

Thanks trappy. Now that I know the correct terminology, I can finally come out of the closet as a gendergoliath.

coined by Baaphomett in 2014

Frequency 0.4%

On all levels, except physical, I am a zerg.

Vore me daddy 🤤🤤🤤

https://nonbinary.wiki/wiki/Xenogender#Quantigender

Quantigender, Quantal Gender, Quantumgender, or Genderquantum. A gender that is an earthly transmutation originating in a conscious awareness of dimensions of reality typically separate from any of the perceptions of everyday life.

I've asked you

TWO

Extremely clear questions.

ONE:

CAN YOU ABIDE BY OUR COMMUNITY'S RULES?

and

TWO:

WERE YOU TRYING TO CALL ME A LIAR?

These are questions I asked YOU.

You can answer them -- or not.

And you can participate here.

Or not.

The moderation team of r/ContraPoints is the moderation team of r/ContraPoints.

YOU are NOT on it.

Before 35 minutes ago, you'd never participated in our community.

How we run our community is our business, and the business of the people who participate here in good faith.

We don't allow disrespect; We don't allow verbal or emotional abuse; We don't allow people to brigade our subreddit and post off-topic posts and metadrama.

What YOU think you know about our moderation team is informed solely by third-hand hearsay and screenshots released by someone abusing their position, edited and therefore cherry picked to support a narrative.

That narrative is abusive.

It will not be allowed.

No one will be allowed to come here and back-seat run our subreddit, or light torches and brandish pitchforks.

So now,

THREE Questions:

The first two still must be answered,

and

AM I PERFECTLY CLEAR THAT YOU ARE NOT A MODERATOR OF THIS SUBREDDIT?

You were banned from /r/Drama because one or more of your comments or submissions in the subreddit violated Rule 2 of the subreddit -- they contained one or more instances of:

  • flamebait,
  • fallacies;
  • were hostile in tone or nature;

  • and -

  • were judged to be made in bad faith.

You may appeal this ban 72 hours from now.

To appeal this ban, you may reply to this in modmail.

In the body of the appeal, you must:

  • Note in the Title or Body of the appeal that it is a "Formal Ban Appeal";
  • Link to the content that you know or suspect to have prompted the ban;
  • Explain in full which of the subreddit rules and/or Reddit Content Policy the content violated;
  • Explain your plan to avoid violating the subreddit rules and/or the Reddit Content Policy in the future;
  • Apologise for the incident.

Appeals submitted without these five elements will not be considered. Responses which are not appeals may be reported to Reddit Administration as Violations of the Reddit Content Policy against Harassment.

You were banned from /r/Contrapoints because you were UNABLE to ANSWER my THREE VERY SIMPLE QUESTIONS.

Seeth

What's this from?

The most powerful janny of all.

I'm not reading all that give tldr

Tldr is bardfinn wears the same underwears for months at a time.

I heard he collects male midget snuff porn.

Every cloud has their silver lining

(See Appendix)

see Appendix example below.

David Foster Wallace over here. I'll tell you one thing, this individual never had a problem reaching the page minimum for school papers.

Idk what the fuck any of this mean I'm way too stoopid for this

Aside from the intergalactic autism required to do a writeup like this, this isn't even what a phishing attack is. A phishing attack is when a fake website masquerades as, say, your bank's website in order to trick you into entering your credentials. What he's describing is just some dude baiting you into acting like a retard. That's not social engineering, or phishing, or any other vaguely techy-sounding words that he clearly doesn't understand. It's just existence on the internet.

I dove in thinking it was going to be something juicy like people getting mod's passwords or home addresses. Really disappointing.

REDDIT IS MY FUCKING LIFE STOP HARASSING ME ITS NOT FUNNY YES I DO THIS FULL TIME JOB WITH NO PAY I'LL TELL ON YOU

Torboautism

Captain sperge of the USS Redditerprise

at what point does it become unethical to make fun of someone for being too autistic? bardfinn seems to be on the low end of the spectrum

good ol' social engineering. The weapon of chad hackers. The autists are unable to be social and therefore cannot socially engineer.