Gab: hack gives unprecedented look into platform used by far right
A data breach at the fringe social media site Gab has for the first time offered a picture of the user base and inner workings of a platform that has been opaque about its operation.
The breach, news of which first emerged in late February, allowed hackers to extract Gab databases that appear to show user accounts and a history of public posts and direct messages.
The user lists appear to mark 500 accounts, including neo-Nazis, QAnon influencers, cryptocurrency advocates and conspiracy theorists, as investors. They also appear to give an overview of verified users of the platform, including prominent rightwing commentators and activists. And they mark hundreds of active users on the site as “automated”, appearing to indicate administrators knew the accounts were bots but let them continue on the platform regardless.
Finally, the data appears to contain direct messages between the Gab CEO, Andrew Torba, and a user who has been identified as a high-profile QAnon influencer, showing the entrepreneur seeking direct feedback on site design from a member of a group that promotes a “spiderweb of rightwing internet conspiracy theories with antisemitic and anti-LGBTQ elements”, according to the Southern Poverty Law Center.
The breach was the first of two hacks targeting Gab in recent weeks. On Monday, the platform went dark after a hacker took over the accounts of 178 users, including Torba and the Republican congresswoman Marjorie Taylor Greene. In messages sent from the pirated accounts, the hackers claimed they had obtained 831 “verification documents” from the site and asked for Bitcoins in exchange for returning them.
High-profile users spew hate
Gab, a Twitter-like website promoted by Torba as a bastion of free speech, has long been a forum of last resort for extremists and conspiracy theorists who have been banned on other online platforms. It attained worldwide notoriety in 2018 when a user, Robert Bowers, wrote on the site that he was “going in”, shortly before allegedly entering the Tree of Life synagogue in Pittsburgh, Pennsylvania, and killing 11 people.
News of the initial breach was first reported by Wired magazine on 28 February, after reports about it had been circulating online. The data was not publicly released, but was offered selectively to reporters and activists by the transparency organization Distributed Denial of Secrets. Torba acknowledged the vulnerability and the breach in a statement released following the leak but did not comment on the authenticity of the data or particular content. He did not respond to the Guardian’s request for comment on its content.
The leaked files contained what appears to be a database of over 4.1 million registered users on the site and tags identifying subscribers as “investors”, “verified” users and “pro” users.
Gab investors contributed in one of three share offerings and one convertible note, a form of short-term debt that converts into equity, according to its financial reporting. The 2017 share offering, for example, required a minimum investment of $199.10, and rewarded investors who contributed a greater amount with “perks”. Users who invested $200 could display a “Gab investor badge” on the site. The badges corresponded with a tag in the database, which allowed investors to be looked at in detail.
Some of the people associated with investors’ accounts had high-profile jobs and public roles, while spewing hate and extremist beliefs online. Among the accounts labeled as an investor is a user named “Manwe Sulimo”, who presents themselves in their user bio as a “former NASA Engineer turned Flat-earther”. The account is littered with posts and reposts of antisemitic, transphobic and pro-Nazi material. At one point the user expressed the opinion that “Jews are Satan’s chosen people”. In their profile, they link to several videos, including a notorious pro-Hitler documentary series.
The University of Michigan email attached to that account belongs to Shane Moore, a 33-year-old resident of Lake Orion, Michigan. While there is no evidence that Moore worked directly with Nasa, papers he co-authored confirm the claims made on his LinkedIn profile that he worked on aspects of NanoFet, an experimental high-speed spacecraft engine, while an engineering student at the University of Michigan.
His LinkedIn profile also says that he is currently a thermal simulation engineer at Fiat Chrysler Automobiles in Auburn Hills, Michigan. Neither Moore nor Fiat Chrysler returned requests for comment.
BiglySpeaks is another account tagged as belonging to an investor. The bio for the account carries hashtags indicating a promotion of Holocaust and coronavirus denial, apparent beliefs that are also reflected in the account’s antisemitic and conspiracyminded posts.
The email address attached to the account belongs to Steven Reid, a former Republican party activist and conservative political blogger in Provo, Utah. In 2011, Reid unsuccessfully ran for secretary of the Utah county Republican party. His now dormant blog, Nacilbupera, was widely cited as a source of information on conservative politics in that state.
Reid did not respond to a request for comment.
‘Pro’ users, verified users and bots
The data breach also appears to offer some insight into users tagged as “verified” by Gab, which according to the platform’s own explanation means that they have completed a verification process that includes matching their display name to a government ID.
Verified users whose email addresses appear to have been exposed in the leak range from longtime political operatives, such as Roger Stone, to farright political commentators including Michelle Malkin and Peter Brimelow, editor of VDare, and far-right activists such as Nick Fuentes and Jared Taylor, who heads the white nationalist organization American Renaissance.
And it appears to include a list of users registered as “pros”, which allows users to access additional features and a badge at a price starting at $99 year. The database indicates over 18,000 users had paid to be pro users at the time of the breach. Nearly 4,000 users were flagged as donors to Gab’s repeated attempts to attract voluntary gifts from users.
More than 770 registered accounts on the platform, including some active ones, appear to be marked in the service’s own database as bots.
The Guardian emailed all of the verified users named above for comment on the breach, but none immediately responded except for Jared Taylor, who wrote in an email: “This hacking operation was a federal crime, but don’t expect the Biden administration to care.”
Direct messages included in the leak appear to show close communication between Torba and a major QAnon influencer who is labeled a Gab investor, seemingly reinforcing the CEO’s public efforts to make Gab a home for adherents to the QAnon conspiracy theory, which helped fuel the 6 January attack on the nation’s Capitol.
In the messages, Torba and the user Neon Revolt, who has been identified as Richard Cornero Jr, a QAnon influencer, discuss the direct messaging feature, then relatively new on the platform. The messages suggest a close relationship between Gab’s CEO and one of the key proponents of a baseless conspiracy theory whose adherents have held, among other things, that Donald Trump was on a secret mission to expose and imprison members of a pedophile ring that included celebrities and high-ranking Democratic politicians.
Cornero did not respond to a request for comment.
‘Negligent or malicious’ about security
According to Wired, the data exposed in the apparent hack was sourced by a hacker who had found a security vulnerability in the site.
Eugen Rochko, the developer of a source codebase named Mastodon that was used by Gab as a basis for its website from early 2019 over Rochko’s objections, believes poor security practices played a significant part in the breach.
Rochko said in an email that Gab adopted Mastodon’s codebase “as a way of circumventing Google’s and Apple’s ban on [Gab’s smartphone app] from their app stores”, but that Gab then removed features that show total numbers of users and active users, and ultimately severed ties with Mastodon’s ongoing development process..
In doing this, Gab’s programmers introduced two serious security vulnerabilities into its code, according to Rochko, one of which was publicized by another programmer in early February. Rochko says that Gab did little to address these “obvious” problems, adding: “I’m not aware of them ever adopting our bug fixes, including important security fixes.”
Megan Squire, a professor of computer science at Elon University and longtime researcher on the far right’s use of internet technologies said the vulnerabilities Gab introduced in its codebase were “basic, basic stuff”.
“Gab was negligent at best and malicious at worst” in its approach to security, she added. “It is hard to envision a scenario where a company cared less about user data than this one.”
Of this week’s hack, Torba said in a post on the site that the hacker had taken advantage of Gab’s failure to clear user authorization tokens following the initial attack, but that Gab had “not independently verified the information that the hacker posted”.
Squire added that her comments “still apply” after this latest breach.
Gab’s chief technology officer, Fosco Marotto, did not respond directly to questions about Gab’s approach to security, writing in an email of the hack: “Our investigation is continuing and we will have more to say on this matter when it has concluded.”
Torba himself initiated communication with the Guardian after it had started contacting users identified in the data breach. Torba sent an empty email with the subject line, “Deuteronomy 28:7”, a Bible verse promising victory over enemies. He did not respond to a return email with questions about his security practices but used his own website to condemn “journos” and other perceived enemies.
This article was amended on 11 March 2021. An earlier version used an incorrect name for the transparency group Distributed Denial of Secrets.