Failure to purge authentication tokens taken in first breach leads to second one.
Hack me (don't) if old.
The compromise came to light after someone hijacked the account of Gab founder and CEO Andrew Torba and left a post criticizing him for not paying an 8 bitcoin ransom for the safe return of documents used to verify the identity of some users. The unknown hacker also accused Torba of failing to disclose the full extent of the earlier breach.
"The attacker who stole data from Gab harvested OAuth2 bearer tokens during their initial attack," Torba wrote. "Though their ability to harvest new tokens was patched, we did not clear all tokens related to the original attack. By reusing these old tokens, the attacker was able to post 177 statuses in an 8-minute period today."
Gab's failure to purge bearer tokens may have stemmed from unfamiliarity with the open source Mastodon code the site runs or an unwillingness to require users to go through the hassle of resetting OAuth2 bearer tokens. The theft of the tokens came as a surprise to many because they weren't included in a trove of hacked Gab data posted by the Wikileaks-style site Distributed Denial of Secrets following the breach.
Hack me (don't) if old.