Fediverse @lemmy.world RCMaehl [Any] @lemmy.world 1y ago

Lemmy just had its first major hack. What happens next:

Hi all,

If you're just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

How?

This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.

Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.

What happens next?

As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you'll likely see:

Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:

Exactly what happened, when.
The incident response that occurred from instance admins
Information that might have helped resolve the issue sooner
Any issues that prevented successful resolution
What should have been done differently by admins
What should be improved by developers
What can be used to identify the next attack
What tools are needed to identify that information

A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.
A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I'll look into crowdfunding this cost.

153

153 comments

This incident made me realize not to use an admin account for my primary lemmy account in my personal instance. I setup another account for instance admin purpose (with 2FA enabled) and keep it logged out, then remove my primary account from the instance admin list.
Having recently migrated from Reddit (and kept up with commercial social media hacks) I'm used to Nothing To See Here! We totally didn't store your personal information in plaintext for hackers to snatch. Oh and maybe please change your passwords. All Part Of The Show!

So, by comparison, the response here is downright heartwarming.
If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.

It could get VERY, VERY expensive... depends on code complexity.
Was lemmy.ml affected ?
A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.

You don't need to pay money. You just need to listen to the recommendations already made by free tools.

Here, fix this shit first and then worry about a professional audit later.
Good reminder that: small instances = small impact. Both true for the positive and the negative.
also, I cannot properly login into my lemmy.world account anymore. username/password work, but when I try to upvote it tells me i gotta be logged in. Tried apps and web.
Friendly remind that Lemmy.world is considering federating with Meta while Lemmy.ml will not.

I would strongly suggesting ditching Lemmy.world for Lemmy.ml before they can even get started with that stupidity.
How do I contact my instance admin?

I went ahead and logged out and back in on my own, but I was not prompted to do so by Lemmy and I don't know enough about this stuff to say whether or not doing it on my own would've helped. I'm still pretty overwhelmed trying to figure this site out, so I apologize if this is a dumb question, just want to make sure I'm doing what I can to protect my own privacy.

I don't want to fall for the millennial version of a Nigerian prince scam, lol.
Good thing we don't have custom emojis on monero.town and the admin account isn't used for things outside of the local community :D
XSS, Seriously?
This post is weird. You're typing like you're in charge of things, but you're apparently not.

It's one thing to show some initiative, but you're literally demanding a full report like the Lemmy devs work for you. You sound like someone who does this kind of thing for a living and felt the need to flex. Because otherwise, what the hell are you even doing?

Setting neurotically-specific demands for the developers makes sense if you represent a big instance or something, but you're literally just a dude. You could have framed this entire post in a different way and gotten away with it. Right now, it's creepy to anybody who actually reads the entire thing.
XSS, classic

Thanks for your hard work, fuck the trolls that always have to poke holes in shit
Does this affect kbin.social? I know we federate with Lemmy, but I think there are also code differences.
Is the sudden unannounced disappearance of Vlemmy related to this ? I had my main account there and it just disappeared
So much drama
I haven’t been able to change my password on Lemmy.world. When I click save, nothing happens and the password doesn’t update.

That’s probably something someone wants to look into.
Sometimes you just have to learn the hard way.
had a login/not logged in loop for a while yesterday. reset lemmy.world site data seems to have fixed
Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.

Probably because the hackers used some http request to get the data and didn't want to wade through thousands of rows of JWT strings.

153 comments