Tech News: Hive Social turns off servers after researchers warn hackers can access all data

[playahaitian]

@easy_b @Camille

Hive Social turns off servers after researchers warn hackers can access all data

Site officials say site will be down for a couple of days.

arstechnica.com

Hive Social turns off servers after researchers warn hackers can access all data
Site officials say site will be down for a couple of days.
DAN GOODIN - Thursday at undefined

Enlarge
Hive Social
108WITH 0 POSTERS PARTICIPATING

• SHARE ON FACEBOOK
• SHARE ON TWITTER

Hive Social, a social media platform that has seen meteoric growth since Elon Musk took over Twitter, abruptly shut down its service on Wednesday after a security advisory warned the site was riddled with vulnerabilities that exposed all data stored in user accounts.
“The issues we reported allow any attacker to access all data, including private posts, private messages, shared media and even deleted direct messages,” the advisory, published on Wednesday by Berlin-based security collective Zerforschung, claimed. “This also includes private email addresses and phone numbers entered during login.”
Enter your email to get the Ars Technica newsletter
Join Ars Technica and
Get Our Best Tech Stories
DELIVERED STRAIGHT TO YOUR INBOX.

SIGN ME UP
By signing up, you agree to our user agreement (including the class action waiver and arbitration provisions), our privacy policy and cookie statement, and to receive marketing and account-related emails from Ars Technica. You can unsubscribe at any time.

The post went on to say that after the researchers privately reported the vulnerabilities last Saturday, many of the flaws they reported remained unpatched. They headlined their post “Warning: do not use Hive Social.”
Hive Social responded by pulling down its entire service.
“The Hive team has become aware of security issues that affect the stability of our application and the safety of our users,” company officials wrote. “Fixing these issues will require temporarily turning off our servers for a couple of days while we fix this for a better and safer experience.”
The Zerforschung post said the vulnerabilities were so serious that they were withholding technical details to prevent the active exploitation of them by malicious hackers.
Advertisement

The series of events raised questions about why Hive Social waited some 72 hours to shut down its site after receiving notification users’ most private data was free for the taking. Zerforschung said that after multiple communications, Hive Social claimed to have fixed all issues when that was clearly not the case. The social media site said it never claimed the vulnerabilities were fixed.
Hive Social’s user base reportedly doubled in the last few weeks, going from about 1 million to 2 million as of last week, according to Business Insider. Despite the massive growth, the social media site continued to be staffed by just two people, neither of whom had much of a background in security.
Representatives of both Hive Social and Zerforschung didn’t respond to questions sent by email.
While there are no reports that the vulnerabilities were actively exploited, there’s no way at the moment to rule that out. Anyone with a Hive Social account should be prepared for the possibility that the data they provided during sign-up, as well as private messages, whether deleted or not, have been obtained.

FURTHER READING
How secure a Twitter replacement is Mastodon? Let us count the ways
The lesson from this event further supports advice Ars gave on Tuesday concerning Mastodon, another social media site that has also seen skyrocketing user numbers in the aftermath of the Twitter takeover by Musk. Put nothing on the site that you wouldn’t mind being public. Confidential information should never be put in direct messages or any other place. Here’s hoping Hive Social users already knew that.

 

[playahaitian]

​

 

[playahaitian]

​

 

[playahaitian]

Twitter alternative Hive shuts down its app to fix critical security issues | TechCrunch

It's an unusual way to patch bugs, to say the least, and one that raises questions about the development workflow at the company.

techcrunch.com

Twitter alternative Hive shuts down its app to fix critical security issues
Sarah Perez@sarahintampa / 10:33 AM EST•December 1, 2022
Comment
Image Credits: Hive
The team at the newly popular Twitter alternative Hive is in over its head. The company has now taken the fairly radical step of fully shutting down its servers for a couple of days in response to concerns raised by security researchers who discovered a number of critical vulnerabilities on Hive, several of which they say remain unfixed. The issues they found would allow attackers access to all data, including private posts and messages, shared media and even deleted direct messages, as well as the ability to edit other people’s Hive posts.
The researchers, a part of a German collective called Zerforschung, claimed they confidentially reported the security vulnerabilities to Hive’s team, noting it was initially difficult to reach a point of contact at the company. Several days later, Hive replied, claiming the issues to be fixed, a Zerforschung blog post explains. However, the researchers found this was not the case, so they took their concerns to the public, warning people against using Hive’s app.
Shortly after, Hive announced it was temporarily shutting down its servers to address these problems. It also claimed, across several tweets, that they never told the researchers the issues were “fixed” but that they were “fixing” them, eventually deciding to go offline until problems were addressed.






It’s an unusual way to patch bugs, to say the least, and one that raises questions about the development workflow at the company. Is there not a dev environment where code is fixed, then staged for a release? How bad was the code that it requires a full stop of company operations to rework it?
These aren’t the first concerns that have been raised about Hive in the weeks following its rapid growth, which has been fueled by Elon Musk’s acquisition of Twitter. Today, a number of Twitter users are unhappy with the direction Musk is taking the social network and have been seeking alternatives. This has led to sizable boosts to the user bases of other social apps, including Mastodon, CoHost, Tumblr, CounterSocial, Post News, Koo and Hive, among others.
But it’s also led to increased scrutiny for Hive, a smaller app that until recently was a two-person team. The company has not always been fully transparent about its inner workings, corporate structure, moderation capabilities or sources of funding. This tends to leave Hive users looking for information on their own, then raising questions about what they dig up.
For example, one of the issues that popped up in the past couple of weeks involved the resurfacing of an older, problematic tweet posted by a former employee, Gil Malfabon, who created Hive’s design system. Hive publicly confirmed Malfabon was no longer with the company, and he privately confirmed the same to TechCrunch. While the designer currently appears listed on tax filings (PDF) as an officer, he says next year’s filing should be accurate.

Hive also recently told TechCrunch it now has two other employees in addition to the 24-year-old founder and self-taught coder Kassandra Pop (who goes by other online usernames like Raluca and Salem). But Pop wouldn’t disclose the full names of her team members when asked, referring to them only as Joshua and Pablo. She said they didn’t want the attention.
The company has also grown to some 2 million users, according to a Business Insider report published on November 22, but hasn’t explained how it’s being funded. (Recent tweets hint that funding conversations are in the works, however.) App store intelligence firm data.ai reports the app has seen just around 1.7 million installs, however.


In terms of the product, Hive has faced several issues. When the company’s server reached capacity under the influx of new users in late November, Hive allowed duplicate usernames to be created. It said that there could be other duplicate usernames from when Hive first launched, as well. The company claims the issue is now fixed, but it’s an obvious security concern as duplicates could allow for impersonation. In addition, Hive frequently replies to Twitter users’ requests for usernames to “free up” their preferred handles for them, as it did recently for YouTuber iJustine — a sort of ad hoc system to address its lack of verification procedures.
Worse, the company has grown a network to millions of users without moderators, security teams or staff focused on GDPR or other regulatory compliance. This could be chalked up to naivete, perhaps, about what it means to run a social network in 2022, but it’s also reckless and negligent. But Hive may get away with it, if the funding arrives.

Pop told Insider she planned to use future funds to hire moderators to filter out gore, violence and child exploitation content, to give you an idea of the urgency. Hive has been asked for comment but did not immediately reply.

 

[playahaitian]

After Discovery of Huge Data Breach, Twitter Alternative Hive Goes Offline

A social platform that saw intense growth in a short period of time has now been forced to pull its servers offline due to a huge security bungle.

gizmodo.com

 

[Mixd]

And they went on Twitter to report that?