We know an issue occurred on the site over an hour ago with someone using my account to redirect the site, make fake posts, and change other settings. The problem has been corrected.

We will continue to monitor the situation and keep you informed.

  • @dezmdEnglish
    46•1 year ago

    Give them some time to investigate maybe?

    • AlmightySnoo 🐢🇮🇱🇺🇦English
      30•1 year ago

      Here’s what I think happened: https://lemmy.world/comment/1059957

      Basically it’s Javascript that was injected in the main sidebar. That means that Lemmy doesn’t escape HTML in the main sidebar (what about community sidebars?) and that Lemmy devs need to prioritize a security audit of the whole code base right now, I did this kind of shit when I was a kid and it’s just insane that Lemmy has this vulnerability, this was not some sophisticated hack.

      What it also means is that it’s very unlikely that any personal data was compromised.

      • @OnlycatsEnglish
        3•1 year ago

        It’s looks like an admin account got compromised.

        • AlmightySnoo 🐢🇮🇱🇺🇦English
          11•1 year ago

          Yes that’s what allowed them to modify the contents of the sidebar, but the more serious problem is that you can put HTML in the sidebar and it won’t be escaped by the Lemmy backend. That’s what allowed this JavaScript redirection.

          • deweydecibelEnglish
            9•1 year ago

            Should also be pointed out the admin is evidently still compromised. The one that posted this thread.

            • AlmightySnoo 🐢🇮🇱🇺🇦English
              4•1 year ago

              I’m opening Pandora’s box: what if all sidebars, not just the main one, have this vulnerability? An admin account being compromised will be the least of our worries if this is the case.

      • trouser_mouseEnglish
        3•1 year ago

        If you are right do you know what are the potential impacts of the vulnerability, what could a malicious individual do?

        Hopefully not handling this many users without a comprehensive security audit!

        • AlmightySnoo 🐢🇮🇱🇺🇦English
          5•1 year ago

          Cookies were likely obtained too, so they could have logged into your account using those cookies and gotten your email address or posted something with your account, but I think it’s more likely they prioritized admin accounts as they were also sending a flag indicating whether the account is an admin or not. Ruud’s has invalidated those cookies a while ago so they’re worthless now and the hacker can’t use them to log in. See ruud’s announcement.

    • @klydeEnglish
      4•1 year ago

      Hope you got that energy for the rest of Lemmy instances because they’re all the same