While I was asleep, apparently the site was hacked. Luckily, (big) part of the lemmy.world team is in US, and some early birds in EU also helped mitigate this. As I am told, this was the issue: - There is an vulnerability which was exploited - Several people had their JWT cookies leaked, including at least one admin - Attackers started changing site settings and posting fake announcements etc Our mitigations: - We removed the vulnerability - Deleted all comments and private messages that contained the exploit - Rotated JWT secret which invalidated all existing cookies The vulnerability will be fixed by the Lemmy devs. Because not all instances are aware, we will not go into detail on the vulnerability yet. Many thanks for all that helped, and sorry for any inconvenience caused! Update While we believe the admins accounts were what they were after, it could be that other users accounts were compromised. Your cookie could have been ‘stolen’ and the hacker could have had access to your account, creating posts and comments under your name, and accessing/changing your settings (which shows your e-mail). For this, you would have had to be using lemmy.world at that time, and load a page that had the vulnerability in it.

Are we impacted?

  • MouseWithBeerEnglish
    5•1 year ago

    Update: this server should hopefully (unless something else shows up) be safe and not vulnerable anymore.

  • @[email protected]English
    4•1 year ago

    We’re all being hacked the moment we signed up for this instance. The owner is a notorious hacker wanted by the FBI, CIA, KGB, Sesame Street, and Megatron. Imagine using an Ubuntu server for an Arch instance! The nerve!

    Jk.

    I hope not, tbh. I do hope instance owners and admins have a Matrix/Discord group where they can communicate in real time with each other. I haven’t seen any of the comments that allegedly contain the exploit locally. Hopefully the ones in charge update us. :)

    • MouseWithBeerEnglish
      4•1 year ago

      We do communicate privately, don’t worry. Been a busy day at work for me till now so I only seen whats going on exactly now (there were just some reports of lemmy.world being hacked when I woke up this morning and nothing more). I just sent the server owner a link as to how to resolve the situation so hopefully its all resolved soon.

      • @[email protected]English
        4•1 year ago

        Thank you. We do appreciate the stuff you guys do behind the scenes. But I have no life so I’m often on lemmy and might see stuff you guys might miss. 😂

        • MouseWithBeerEnglish
          4•1 year ago

          Yea, for me it depends a lot on the day how much time I spend here. Some days hours some days 0, so I might miss some stuff but hopefully the other 2 catch them or someone reports it to us.

          Sören (he is the one that actually owns it) just replied to me, so should be sorted very soon. I guess one of us will update once its done (or you might notice the server going down for a restart).

          • @[email protected]English
            3•1 year ago

            The site is only vulnerable if you used custom emoji’s for this instance of lemmy. Otherwise you can ignore this.

      • @[email protected]English
        2•1 year ago

        That was my first reaction, too. That’s an upside to being a small instance. Can’t let our guard down, though.