Troy Hunt discovered a significant API vulnerability in the social media platform Spoutible that allows hackers to potentially take over user accounts. Hunt's investigation revealed that exploiting Spoutible's API could expose users' names, usernames, bios, emails, IP addresses, and phone numbers.
Spoutible promptly addressed the issue, clarifying in a post that while decrypted passwords and direct messages remained secure, the compromised information included email addresses and some phone numbers, according to a report from The Verge. In response, the platform urges users to participate in a "special pod session," advising a password change and the resetting of two-factor authentication (2FA).
Even more alarmingly, Hunt discovered that bad actors could exploit the flaw to obtain hashed versions of users' passwords, potentially decrypting weak or short passwords. The API also returned 2FA codes and reset tokens, allowing discreet account hijacking.
This is pretty wild, it's not often you see an API returning customers' bcrypt password hashes, 2FA secrets and the token you can use to reset passwords 😲 https://t.co/SSNVpcMGfn
— Troy Hunt (@troyhunt) February 5, 2024
Approximately 207,000 user emails were exposed, emphasizing the severity of the breach. This incident adds to a growing list of data-scraping occurrences on platforms like Facebook and Trello, emphasizing the critical need for vigilant security measures on social media platforms.
Spoubtible Celebrates First Year Anniversary
Christopher Bouzy, founder of Twitter analytics service Bot Sentinel, launched Spoutible in February 2023, addressing concerns such as online harassment, hate speech, and misinformation. The social media platform has swiftly transformed into a significant hub for meaningful online interactions. With stringent rules, Spoutible positions itself as a secure and respectful online communication environment.
In a Wired article, Bouzy expressed optimism about Spoutible's future, especially if a particular user demographic-particularly journalists-creates the majority of new accounts. Recognizing the symbiotic relationship between platforms and journalists, Bouzy envisions a concerted effort to attract more journalists to Spoutible.
As Spoutible marks its first anniversary as a black-owned social media platform, it renaubs committed to its promotion of diversity, inclusivity, and user safety. Boasting explosive organic growth with millions of monthly visits and page views, Spoutible's success is attributed to transparent rules, strict policies, and innovative features, including a customizable timeline and interactive audio chat rooms (Pods), as per the firm's media release published by Newswire.
Upcoming Innovations, Milestones
With plans to introduce new features like an artificial intelligence assistant and interest-based connections, Spoutible aims to enhance user engagement. Recent financial successes include raising nearly $600,000 through a Wefunder campaign with the support of over 1,400 community members. This financial support underscores Spoutible's potential for continued development and expansion.
"We are immensely proud of what we have achieved in just one year," Spoutible Founder and CEO Christopher Bouzy, noting that his firm's accomplishments stand as its "testament to the power of community support and our unwavering commitment to creating a safer online environment for all."
As Spoutible enters its second year, it remains committed to fostering a safer and more inclusive online environment. Balancing growth and innovation with the core values of user safety, diversity, and inclusivity, the social platform continues to garner attention from observers and users alike in the dynamic social media landscape.
