173
Warning: lemmy.world just got hacked
(beehaw.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 10 Jul 2023
173 points (100.0% liked)
Beehaw Support
2794 readers
1 users here now
Support and meta community for Beehaw. Ask your questions about the community, technical issues, and other such things here.
A brief FAQ for lurkers and new users can be found here.
Our September 2024 financial update is here.
For a refresher on our philosophy, see also What is Beehaw?, The spirit of the rules, and Beehaw is a Community
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
this is fucking hilarious, this is going to be a blow to confidence in the security of the fediverse
i wonder if the websites that covered the reddit protest will cover this
Surely it's not really any different to any other website's admin having their account hacked/their password socially engineered? It's not an inherent flaw in the fediverse as a whole, just a human issue.
EDIT: see @Zephyrix's comment below. It was a security flaw.
This was not a social engineering. It was a JavaScript injection that stole browser cookies, bypassing password changes and 2FA.
However, it seems lemmy.world was running a custom version of the UI. So it's possible that it only affected their instance. Hard to say at this point.
Oh, well in that case it's a little more concerning. But I don't expect it to be a long-term issue. It certainly isn't a serious blow to my confidence in the security of the fediverse, that's for sure! It being a somewhat minor breach may be a blessing, also; it means there'll almost certainly be more of a focus on security going forward before something more serious happens.
Arguably it is a strength. Unless a user has used the same username and password for different instances, their credentials on one instance are shielded from exploit over the whole network. The potential risk can only really be determined by how security was breeched. If it was social engineering, then there isn't any other direct concern. If it was a vulnerability in software, then the same attack could be played out on other instances, but that's not any different than other systems like a Linux kennel exploit.
Run alpha software, experience alpha security flaws. It's not going to really say anything about the Fediverse at large, but it's more a tale of caution for the Threadiverse specifically, which is FAR younger, but has grown explosively, especially given that Lemmy is early beta status and KBin is alpha status
it would be a lesson for all instances, not just world. i hope they provide more details so others can take note