3290

Lemmy.world (and some others) were hacked (lemmy.world)

submitted 1 year ago* (last edited 1 year ago) by ruud@lemmy.world to c/lemmyworld@lemmy.world

724 comments fedilink hide all child comments

While I was asleep, apparently the site was hacked. Luckily, (big) part of the lemmy.world team is in US, and some early birds in EU also helped mitigate this.

As I am told, this was the issue:

There is an vulnerability which was exploited
Several people had their JWT cookies leaked, including at least one admin
Attackers started changing site settings and posting fake announcements etc

Our mitigations:

We removed the vulnerability
Deleted all comments and private messages that contained the exploit
Rotated JWT secret which invalidated all existing cookies

The vulnerability will be fixed by the Lemmy devs.

Details of the vulnerability are here

Many thanks for all that helped, and sorry for any inconvenience caused!

Update While we believe the admins accounts were what they were after, it could be that other users accounts were compromised. Your cookie could have been 'stolen' and the hacker could have had access to your account, creating posts and comments under your name, and accessing/changing your settings (which shows your e-mail).

For this, you would have had to be using lemmy.world at that time, and load a page that had the vulnerability in it.

(page 3) 50 comments

sorted by: hot top controversial new old

[-] gsdsam@lemmy.world 14 points 1 year ago

Could admins sign announcements with a PGP key to mitigate false admin posts and the consequences this might have? Or is this no longer necessary?

load more comments (8 replies)

[-] pascal@lemm.ee 13 points 1 year ago

That doesn't surprise me. Especially the "homemade" instances. The documentation is severely lacking and I had to fix lots of stuff in the instructions with try&despair to make my instance run.

There's not a great focus in security if your application starts with "step 1: install docker"

load more comments (1 replies)

[-] AlmightySnoo@lemmy.world 13 points 1 year ago

One thing I don't get. Custom emojis can only be created by an admin, but you're saying an admin's account here got compromised because of that and not the other way around. Does that mean that an evil instance set a custom emoji with the injected JavaScript and propagated it to the federated instances?

[-] Calyhre@lemmy.world 11 points 1 year ago* (last edited 1 year ago)

From the fix, I believe the custom emojis were not double checked after a user submits a post. The post data was used to display the emojis, and thus allowing injection.

The fix now is to search the emojis in the custom emojis list from the backend rather than the user post.

[-] irkli@lemmy.world 13 points 1 year ago

That shit sucks, I'm so sorry. I'm glad you got it under control. Nothing but admiration from me for doing all this hard work.

New code, new challenges. It's a new world out there and largely is pretty great. Thanks again.

[-] cantevencode@lemmy.world 13 points 1 year ago

Does an admin account have any permissions to view email addresses or data of registered users?

Did MichelleG not have 2FA enabled?

Now that this has happened, it's be worth pushing this issue through as high priority. If HttpOnly was enabled, then an admin takeover would not have been possible.

https://github.com/LemmyNet/lemmy-ui/issues/1252

load more comments (5 replies)

[-] slowcurrent@sh.itjust.works 12 points 1 year ago

How do we know you're the real you? This all could be part of the plan!

[-] ruud@lemmy.world 13 points 1 year ago

I'm not even sure myself..

[-] TrickyCamel@lemmy.world 12 points 1 year ago

Thanks for the transparency.

[-] fikran@thebag.social 12 points 1 year ago

Ugh, people should not go after systems trying to give a free service to the internet. It just ruins everything.

load more comments (2 replies)

[-] harry_h0udini911@lemmy.fmhy.ml 12 points 1 year ago

Great lemmies! Thanks for uniting us.

[-] mintiefresh@lemmy.ca 12 points 1 year ago

Thanks for the great work. The response time was awesome, considering you were asleep as well.

[-] ColleenLawson@lemmy.world 11 points 1 year ago

Yah, I noticed my Lemmies auto-corrupted to Lemurs.

I don't care. I'm keeping it.

Lemurs are cute.

load more comments (1 replies)

[-] Tuesdays@lemmy.world 11 points 1 year ago

I had to create a new account. I tried enabling 2FA on my main account a week ago, but was never able to generate a token. Now when I try logging in it is asking for my 2FA token. Is there any way to get my account back. I'm a moderator of a community.

load more comments (4 replies)

[-] cheeseblintzes@lemmy.world 11 points 1 year ago

Once again, thank you guys for all that you do. As many other people are saying, appreciate the transparency about these things.

load more comments (1 replies)

[-] eluri@lemmy.world 11 points 1 year ago

Soo it looks like the entry for this instance was also changed on https://lemmyverse.net/ . At least I hope it is the hack

load more comments (6 replies)

[-] ulu_mulu@lemmy.world 10 points 1 year ago

Amazing how you quickly reacted to this!! Bravo!!

TIP: if you can't login after what happened, clear out your browser cache including ALL cookies, that fixes it (it did for me at least). I believe it's also advisable to change lemmy password.

[-] feedum_sneedson@lemmy.world 10 points 1 year ago

I can only log in on incognito mode, which makes me think my cookie has been stolen or whatever. So my question is, what should I be doing about that?

load more comments (11 replies)

[-] 00Xero00@lemmy.world 9 points 1 year ago* (last edited 1 year ago)

I can't log into my account anymore, this one is a new one I've just made. I tried to reset my password but nothing came in the mailbox. I can still see comments and posts from that account though.

It's this one:

And I don't know why but I can't save the profile pic for this account.

Edit: Nvm, I use another email to sign up for Lemmy and forgot about it

load more comments (2 replies)

[-] Macaroni_ninja@lemmy.world 9 points 1 year ago

As someone in EU I didn't even realized there was an issue. Well done and great reaction time! Also thank you for the transparency 👑

[-] Legendsofanus@lemmy.world 9 points 1 year ago

This is so sad lmao rip. With any site growing as fast as these instances (because of the Reddit folk) Ig these attacks are to be expected. Hope everyone's accounts and personal info are okay