The social network Parler, which is particularly popular with right-wing extremists and right-wing extremists and has since been taken offline by Amazon, apparently had several serious security gaps. According to their own statements, internet activists archived roughly 70 Tbytes of posts, videos and images, including geodata, from the platform in a coordinated action. After the events at the Capitol in Washington, Parler came under heavy criticism.

According to a hacktivist and Security researcher, who is represented on Twitter as @donk_enby, was able to create masses of verified accounts on Parler. The Parler API could also be used to see which existing accounts had administration and moderation rights. If the password reset function was activated for these accounts, the password could be changed directly because Twilio no longer sent verification emails and the old password was not required.

Public data tapped This made it easier to read out and save URLs via which the content delivery network made publicly accessible content such as posts, videos and images available. In order to automate the download of the data, the activists created a Docker container through which the content behind the URLs was downloaded and then archived. The hackers assure that they have only accessed public data. However, observers have already pointed out that many users had published contact details.

The metadata of the tapped content can already be viewed and can be traced back with Google’s help, for example. The content itself should also be made available. According to the activists, they can be assigned to the users who originally uploaded them to Parler, where they are no longer accessible. Much of the content uses metadata to provide information about when and where a photo was taken, for example. Particularly spicy: In order to get the “Verified Citizen” status on Parler, users have to upload scans of their ID documents.

(ndi)