Lemmy.world (and some others) were hacked - LemmyWorld
lemmy.world
While I was asleep, apparently the site was hacked. Luckily, (big) part of the lemmy.world team is in US, and some early birds in EU also helped mitigate this. As I am told, this was the issue: - There is an vulnerability which was exploited - Several people had their JWT cookies leaked, including at least one admin - Attackers started changing site settings and posting fake announcements etc Our mitigations: - We removed the vulnerability - Deleted all comments and private messages that contained the exploit - Rotated JWT secret which invalidated all existing cookies The vulnerability will be fixed by the Lemmy devs. Because not all instances are aware, we will not go into detail on the vulnerability yet. Many thanks for all that helped, and sorry for any inconvenience caused! Update While we believe the admins accounts were what they were after, it could be that other users accounts were compromised. Your cookie could have been ‘stolen’ and the hacker could have had access to your account, creating posts and comments under your name, and accessing/changing your settings (which shows your e-mail). For this, you would have had to be using lemmy.world at that time, and load a page that had the vulnerability in it.

A number of Lemmy instances have been hacked overnight.

Some may remain inaccessible until they have been secured and restarted.

As a safety precaution logged-on sessions on many servers have been cancelled and you are required to logon again.

Unfortunately, the only way I could find to do this in Liftoff! is by going to Settings > Accounts and deleting each local account by long pressing on it, and then create it again.

All your posts, comments and bookmarks should be preserved during this process.

Please see the linked posts for further details as they emerge.

Thanks all, and please bear with us as this gets resolved.

  • jherazob
    21•1 year ago

    This seems to be the issue, a code injection using custom emojis. Apparently Lemmy is letting some unsanitized data in, which means that Little Bobby Tables strikes again. Somebody was afraid the attackers had seized control of the whole Lemmy network but federation helps hinder the damage here, only individual instances are affected and they’d have to attack each one independently, a single server service would be fully affected in this case.

    Beehaw has fully taken down the server as a preventive measure, i imagine they won’t be the last ones doing this.

    • dismalnow
      9•1 year ago

      This makes me shudder from my time running forums.

      OOB vbulletin was notoriously bad at fending off sql injections, and required CONSTANT monitoring, tweaking, or disabling of basic features to keep the Syrian Liberation Army (as one particular example) from pwning an admin account.

      Also, and covered in detail, JWT should not be your default for sessions.

  • @TwinTurboEnglish
    15•1 year ago

    Unfortunately, the only way I could find to do this in Liftoff! is by going to Settings > Accounts and deleting each local account by long pressing on it, and then create it again.

    Thanks! This is what I did and it worked fine.

    • @Cabeza2000English
      1•1 year ago

      This was driving me crazy. :)

  • VampEnglish
    9•1 year ago

    Removed by mod

    • @myklMEnglish
      10•1 year ago

      That’s Team CET hard at work while America sleeps 😀

  • andre3000
    7•1 year ago

    oh shit, is that what happened? i was so confused about what was going on last night. having just created my lemmy account.

  • @SkellybonesEnglish
    7•1 year ago

    I manage to log back in my just by relogging my account. I thought I was banned or something

    • @myklMEnglish
      2•1 year ago

      Heh, I was sitting there for a few minutes this morning going “oh no what have I broken?” before I found out I could blame hackers.

      • @SkellybonesEnglish
        2•1 year ago

        We’re in the big leagues now, we got hackers after us. Maybe it was some pissed off reddit user

  • @V4ubanEnglish
    2•1 year ago

    Thank you for this!

  • @Lifecoach5000English
    2•1 year ago

    I actually didn’t have to delete my existing lemmy.world account but I had to re-add it like it was a new account and log in and seemed to fixed it.