According to DDoSecrets’ Best, the hacker says that they pulled out Gab’s data via a SQL injection vulnerability in the site—a common web bug in which a text field on a site doesn’t differentiate between a user’s input and commands in the site’s code, allowing a hacker to reach in and meddle with its backend SQL database. Despite the hacker’s reference to an “Anonymous Revival Project,” they’re not associated with the loose hacker collective Anonymous, they told Best, but do “want to represent the nameless struggling masses against capitalists and fascists.”
WIRED reached out to Gab for comment Friday, offering to share what we’d learned about the nature of the site’s data breach. The company’s CEO, Andrew Torba, responded in a public statement on the company’s blog that “reporters, who write for a publication that has written many hit pieces on Gab in the past, are in direct contact with the hacker and are essentially assisting the hacker in his efforts to smear our business and hurt you, our users.” (WIRED has had no direct contact with the hackers, to our knowledge, only DDoSecrets.)
Responding to WIRED’s mention of a SQL injection vulnerability, Torba’s initial statement noted that “we were aware of a vulnerability in this area and patched it last week. We are also proceeding to undertake a full security audit.” The post went on to state that Gab doesn’t collect personally identifiable information from its users such as telephone numbers, Social Security numbers, birth dates, or health and financial information. “DMs were only live for a few weeks and are not currently a feature supported by the site, so if a breach has in fact occurred in that domain we expect the number of affected accounts to be low,” Torba added. “As we learn more about this alleged breach, we will notify the community publicly with our findings as required by law.”
Torba did not confirm that a security breach had occurred in his Friday statement. But in a follow-up on Sunday, Torba used a transphobic slur to insult the hackers “attacking” the site and added that both his and Donald Trump’s accounts had been “compromised.” (DDoSecrets was careful to note to WIRED that it has not attempted to crack any of the hashed passwords or tested any of the plaintext passwords in the hacked data. WIRED hasn’t either.)
“The entire company is all hands investigating what happened and working to trace and patch the problem,” Torba wrote Sunday.
Gab is the second far-right social media site to be deeply hacked in as many months. Following the Capitol Hill riot in January, other hacktivists used a simple security flaw in the bustling social media site Parler to download all of its public contents, including the location data embedded in every photo and video Parler users had posted. That Parler data, which placed several users at Capitol Hill on January 6, was preserved by the Internet Archive and also made available by DDoSecrets.
When Amazon booted Parler from its hosting service in January, many of the site’s users flocked to Gab. But until now, hacktivists have had a hard time downloading public Gab posts as they did with Parler, says Max Aliapoulios, a graduate researcher at the New York University Center for Cybersecurity, with whom DDoSecrets has shared a copy of the hacked Gab data. Due mostly to Gab’s instability and frequent downtime, Aliapoulios found that he couldn’t easily use an automated tool to scrape the site.