An Absurdly Basic Bug Let Anyone Grab All of Parler's Data

[douglas9]

THE SOCIAL MEDIA platform Parler rose to prominence as an outlet for free speech. In practice, it became a haven for disinformation, hate speech, and calls for violence, the sort of content generally blocked on more mainstream platforms like Twitter and Facebook. It's fair to say, though, that by "free speech" the site's creators didn't mean that anyone could freely download every message, photo, and video posted to the site, including sensitive geolocation data. But a very basic bug in Parler's architecture nonetheless seems to have made it all to easy to do just that.

Late Sunday night, Parler went offline after Amazon Web Services cut off hosting for the social media outlet, a decision that followed the site's use as a tool to plan and coordinate an insurrectionist, pro-Trump mob's invasion of the US Capitol building last week. In the days and hours before that shutdown, a group of hackers scrambled to download and archive the site, uploading dozens of terabytes of Parler data to the Internet Archive. One pseudonymous hacker who led the effort and goes only by the twitter handle @donk_enby told Gizmodo that the the group had successfully archived "99 percent" of the site's public contents, which she said includes a trove of "very incriminating" evidence of who participated in the Capitol raid and how.

By Monday, rumors were circulating on Reddit and across social media that the mass disemboweling of Parler's data had been carried out by exploiting a security vulnerability in the site's two-factor authentication that allowed hackers to create "millions of accounts" with administrator privileges. The truth was far simpler: Parler lacked the most basic security measures that would have prevented the automated scraping of the site's data. It even ordered its posts by number in the site's URLs, so that anyone could have easily, programmatically downloaded the site's millions of posts.

https://www.wired.com/story/parler-hack-data-public-posts-images-video/

[Pachamama]

1. Good Bug

[Merlot]

2. Wasn't it built on WordPress?

[douglas9]

3. Parler Users Breached Deep Inside U.S. Capitol Building, GPS Data Shows

At least several users of the far-right social network Parler appear to be among the horde of rioters that managed to penetrate deep inside the U.S. Capitol building and into areas normally restricted to the public, according to GPS metadata linked to videos posted to the platform the day of the insurrection in Washington.

The data, obtained by a computer hacker through legal means ahead of Parler’s shutdown on Monday, offers a bird’s eye view of its users swarming the Capitol grounds after receiving encouragement from President Trump — and during a violent breach that sent lawmakers and Capitol Hill visitors scrambling amid gunshots and calls for their death. GPS coordinates taken from 618 Parler videos analyzed by Gizmodo has already been sought after by FBI as part of a sweeping nationwide search for potential suspects, at least 20 of whom are already in custody.

The siege on January 6, which lasted approximately two hours, resulted in five deaths, including that of a Capitol police officer whom authorities say was bludgeoned with a fire extinguisher and later succumbed to his injuries. Windows were smashed, tables overturned, and graffiti scrawled and scratched into the walls of the 220-year-old building—some calling for the murders of journalists sheltering in place nearby.


https://gizmodo.com/parler-users-breached-deep-inside-u-s-capitol-building-1846042905?scrolla=5eb6d68b7fedc32c19ef33b4

[Celerity]

4. K & R for visibility