2883

Lemmy.world (and some others) were hacked (lemmy.world)

submitted 1 year ago* (last edited 1 year ago) by ruud@lemmy.world to c/lemmyworld@lemmy.world

684 comments fedilink hide all child comments

While I was asleep, apparently the site was hacked. Luckily, (big) part of the lemmy.world team is in US, and some early birds in EU also helped mitigate this.

As I am told, this was the issue:

There is an vulnerability which was exploited
Several people had their JWT cookies leaked, including at least one admin
Attackers started changing site settings and posting fake announcements etc

Our mitigations:

We removed the vulnerability
Deleted all comments and private messages that contained the exploit
Rotated JWT secret which invalidated all existing cookies

The vulnerability will be fixed by the Lemmy devs.

Details of the vulnerability are here

Many thanks for all that helped, and sorry for any inconvenience caused!

Update While we believe the admins accounts were what they were after, it could be that other users accounts were compromised. Your cookie could have been 'stolen' and the hacker could have had access to your account, creating posts and comments under your name, and accessing/changing your settings (which shows your e-mail).

For this, you would have had to be using lemmy.world at that time, and load a page that had the vulnerability in it.

(page 3) 50 comments

sorted by: hot top controversial new old

[-] TrickyCamel@lemmy.world 12 points 1 year ago

Thanks for the transparency.

[-] MeshPotato@lemmy.world 12 points 1 year ago

Thanks for your efforts. I know that Lemmy was put in place rather quickly as a Reddit alternative. But I'm genuinely hopeful that this will be a good alternative.

[-] cantevencode@lemmy.world 12 points 1 year ago

Does an admin account have any permissions to view email addresses or data of registered users?

Did MichelleG not have 2FA enabled?

Now that this has happened, it's be worth pushing this issue through as high priority. If HttpOnly was enabled, then an admin takeover would not have been possible.

https://github.com/LemmyNet/lemmy-ui/issues/1252

load more comments (5 replies)

[-] fikran@thebag.social 12 points 1 year ago

Ugh, people should not go after systems trying to give a free service to the internet. It just ruins everything.

[-] harry_h0udini911@lemmy.fmhy.ml 12 points 1 year ago

Great lemmies! Thanks for uniting us.

[-] slowcurrent@sh.itjust.works 12 points 1 year ago

How do we know you're the real you? This all could be part of the plan!

load more comments (1 replies)

[-] irkli@lemmy.world 12 points 1 year ago

That shit sucks, I'm so sorry. I'm glad you got it under control. Nothing but admiration from me for doing all this hard work.

New code, new challenges. It's a new world out there and largely is pretty great. Thanks again.

[-] ColleenLawson@lemmy.world 11 points 1 year ago

Yah, I noticed my Lemmies auto-corrupted to Lemurs.

I don't care. I'm keeping it.

Lemurs are cute.

load more comments (1 replies)

[-] eluri@lemmy.world 11 points 1 year ago

Soo it looks like the entry for this instance was also changed on https://lemmyverse.net/ . At least I hope it is the hack

load more comments (6 replies)

[-] feedum_sneedson@lemmy.world 10 points 1 year ago

I can only log in on incognito mode, which makes me think my cookie has been stolen or whatever. So my question is, what should I be doing about that?

load more comments (11 replies)

[-] cheeseblintzes@lemmy.world 10 points 1 year ago

Once again, thank you guys for all that you do. As many other people are saying, appreciate the transparency about these things.

load more comments (1 replies)

[-] LeHappStick@lemmy.world 10 points 1 year ago

Pardon the ignorance, but how do I know if I was compromised? what do?

load more comments (8 replies)

[-] mintiefresh@lemmy.ca 10 points 1 year ago

Thanks for the great work. The response time was awesome, considering you were asleep as well.

[-] AlmightySnoo@lemmy.world 9 points 1 year ago

One thing I don't get. Custom emojis can only be created by an admin, but you're saying an admin's account here got compromised because of that and not the other way around. Does that mean that an evil instance set a custom emoji with the injected JavaScript and propagated it to the federated instances?

[-] Calyhre@lemmy.world 9 points 1 year ago* (last edited 1 year ago)

From the fix, I believe the custom emojis were not double checked after a user submits a post. The post data was used to display the emojis, and thus allowing injection.

The fix now is to search the emojis in the custom emojis list from the backend rather than the user post.

[-] 00Xero00@lemmy.world 9 points 1 year ago* (last edited 1 year ago)

I can't log into my account anymore, this one is a new one I've just made. I tried to reset my password but nothing came in the mailbox. I can still see comments and posts from that account though.

It's this one:

And I don't know why but I can't save the profile pic for this account.

Edit: Nvm, I use another email to sign up for Lemmy and forgot about it

load more comments (2 replies)

[-] ulu_mulu@lemmy.world 9 points 1 year ago

Amazing how you quickly reacted to this!! Bravo!!

TIP: if you can't login after what happened, clear out your browser cache including ALL cookies, that fixes it (it did for me at least). I believe it's also advisable to change lemmy password.

[-] Tuesdays@lemmy.world 9 points 1 year ago

I had to create a new account. I tried enabling 2FA on my main account a week ago, but was never able to generate a token. Now when I try logging in it is asking for my 2FA token. Is there any way to get my account back. I'm a moderator of a community.

load more comments (4 replies)

[-] mackwinston@feddit.uk 9 points 1 year ago

This is why I've decided against running my own Lemmy instance. Too much work to have to keep up constantly with updating, too big of an attractive target for attackers.

load more comments (3 replies)

[-] Autumbloom@lemmy.world 8 points 1 year ago

Thanks for the transparency. Was having issues with Lemmy, now seems everything back to normal. Got a question, Just to add an extra layer of security, Do i need to use ToR or VPN with Lemmy ?

load more comments (2 replies)

[-] Macaroni_ninja@lemmy.world 8 points 1 year ago

As someone in EU I didn't even realized there was an issue. Well done and great reaction time! Also thank you for the transparency 👑