software hive forced to shut down servers

Hive Fail Penetration Test and Go Offline

Hive Social
Image Credit: Hive Social

Hive was forced to go offline over safety concerns reported by German penetration testers Zerforschung. Initially Hive hoped to be down for one or two days however a further announcement said that they won’t be able to fix them as fast as they had hoped. It’s not clear when Hive will be back online or if any malicious hackers have exploited the vulnerabilities before they were reported.

Attacker to access all data

On 30 November Zerforschung released a statement saying:

The issues we reported allow any attacker to access all data, including private posts, private messages, shared media and even deleted direct messages. This also includes private email addresses and phone numbers entered during login. Attackers can also overwrite data such as posts owned by other users.

This must come as a blow to Hive as they recently hit over 1 million active users in their bid to be a Twitter alternative. Since Elon Musk’s take over of Twitter a proportion of their userbase have left and are looking for a new social platform. The main contenders are Mastodon, Parler and Hive Social but the recent server downtime and security concerns are likely to put a slowdown to Hive’s development.

Forced to go offline

It took Zerforschung three days to discover the vulnerabilities and on 27 November they reported them to Hive. The first attempt to call Hive’s CEO Kassandra Pop got rejected. It wasn’t until after Zerforschung contacted admins that the CEO tried to review the security report but she couldn’t find the report in her emails.

Hive has deactivated its servers to protect users

Then, it still took five hours for Hive to respond in acknowledgement of the vulnerabilities. Later that evening it appeared no security measures been taken and Zerforschung pushed for a timeline to fix the issues. On 30 November tests indicated that one of the issues was fixed but some still remained. Later that day, Zerforschung went public with the vulnerabilities and on 1 December Hive deactivated its servers.

Zerforschung will not go into depth about the vulnerabilities to protect the privacy of users at this time.

James Capell

Technical editor and journalist. I have a particularly strong interest in NLP, AI ethics and cyber crime. Not too fond of cats.