• maegul (he/they)@lemmy.ml
    0·
    2 years ago

    Hmmm. Don’t know what the fall out of this will be. But a lot of lemmy is on that server. Unfortunately. Maybe we’ll learn a lesson in the value of decentralisation.

    Ruud also runs mastodon.world, FYI.

    • Lemon@lemmy.blahaj.zoneEnglish
      0·
      2 years ago

      This is why it makes sense for communities to not all pile into one instance, it gives one instance admin too much power and responsibility over everything.

    • Vilian@lemmy.ca
      0·
      2 years ago

      was just some of the admin in the lemmy, i don’t think they share the same admins

    • Stovetop@lemmy.ml
      0·
      2 years ago

      It looks like they’re in the process. The compromised account was demoted from admin and I see posts are being removed. There will definitely need to be some sort of investigation into how this happened, though.

  • Max-P@lemmy.max-p.meEnglish
    0·
    2 years ago

    GitHub PR fixing the bug: https://github.com/LemmyNet/lemmy-ui/pull/1897/files

    If your instance has custom emojis defined, this is exploitable everywhere Markdown is available. It is NOT restricted to admins, but can be used to steal an admin’s JWT, which then lets the attacker get into that admin’s account which can then spread the exploit further by putting it somewhere where it’s rendered on every single page and then deface the site.

    If your instance doesn’t have any custom emojis, you are safe, the exploit requires custom emojis to trigger the bad code branch.

    • Kayn@dormi.zoneEnglish
      0·
      2 years ago

      But won’t custom emojis from remote instances still trigger the exploit?

    • StudioLE@programming.devEnglish
      0·
      2 years ago

      I’m not particularly familiar with XSS but I’m curious how a frontend exploit can compromise an instance?

      Presumably the injected XSS stores the admin’s JWT somewhere for the exploiter?

      Then using that JWT they can effectively login as the admin which gives them access to whatever admin dashboard there is, but does that actually compromise the backend at all?

      edit: for anyone curious there’s a bit of a breakdown of how it works here: https://feddit.win/comment/244427

      • CMahaff@lemmy.mlEnglish
        0·
        2 years ago
        1. Inject exploit into a comment using custom emoji.
        2. Front-end parses the emoji incorrectly allowing JavaScript to be injected.
        3. JavaScript loads for everyone to views a page with the comment and sends their token and account type to the hackers domain.
        4. Hacker parses received tokens for admins and uses that to inject redirects into the front page of the Lemmy instance.

        To answer your other questions:

        • IMO there probably should be better parsing to remove this stuff from the back-end, so I’m not sure the front-end solution is the complete solution, but it should get things largely under control.
        • Back-end is theoretically not compromised besides needing to purge all the rogue comments. Attacker presumably never had access to the server itself.
        • Probably needs to be a mass reset of ALL passwords since lots of people’s tokens were sent during the attack, so their accounts could be compromised.
    • maegul (he/they)@lemmy.mlEnglish
      0·
      2 years ago

      Yea, bad timing it seems, especially as lemmy just got on top of its scaling issues.

      They seem to be unrelated. The vlemmy story is mysterious, unless something new came out, but either their home server died or they got scared of whatever bad/illegal stuff landed on their home server and just wiped it all and walked away. A bad story that shouldn’t happen, but, if true, a bad admin that we are probably better off without unless they do things somewhat better.

      The lemmy.world story seems to be that an admin had their credentials hacked. Not good but also somewhat ordinary. Hopefully they just need some better security practices. There are questions around how much lemmy the software contributed to this hack and how much it can prevent a rogue admin from causing damage. I’d bet that there are improvements to be made but that in the end any admin of anything is a vulnerable point of attack. This may just be an individual’s bad luck or bad practices.

      For me, it highlights the issues with having relatively centralised instances like lemmy.world. One admin gets hacked and a quarter of lemmy is under their control!

  • TotoroTheGreat@lemmy.ml
    0·
    2 years ago

    I decided to check it and it tells me that ‘The site has been seized by Reddit for copyright infringement’.

    • figaro@lemdro.id
      0·
      2 years ago

      I was once doing work at a company that provided tech support and security for local businesses. There were a couple big instances of the companies being hacked with ransomware etc. On every occasion, we of course ask, “when was your last backup done?” And without fail, every one of them always responded, “backup?”

    • Stovetop@lemmy.mlEnglish
      0·
      2 years ago

      One of the admin accounts appears to have been compromised. The owner/other admins appear to be aware now because that account had its admin access revoked and offending posts are being removed.

      Definitely opens up a big question about the security of Lemmy instances that I am sure will be discussed over the next few days.

      • eerongal@ttrpg.networkEnglish
        0·
        2 years ago

        Definitely opens up a big question about the security of Lemmy instances that I am sure will be discussed over the next few days.

        They added 2FA login to lemmy in one of the newer updates. Probably pretty pertinent for any admins to use it…

        • ebits21@lemmy.caEnglish
          0·
          2 years ago

          It’s buggy and missing some key checks to make sure it’s working when you set it up.

          Real risk of locking yourself out of your account.

            • ebits21@lemmy.caEnglish
              0·
              2 years ago

              Mostly a risk on initial setup.

              I’ve been waiting a bit for it to stabilize and just using huge random passwords

              • Zetaphor@zemmy.ccEnglish
                0·
                2 years ago

                If you’re using a password manager you’d be doing this for every site and without even having to think about it. Bitwarden is a great choice.

                • The Cuuuuube@beehaw.orgEnglish
                  0·
                  2 years ago

                  I like KeePass. Bitwarden currently has an nginx exposure in the Dockerfile published in their git repo (may have been fixed since a couple of days ago). That said, I used Bitwarden for many years and switched out of an abundance of paranoia, and am definitively not recommending against it. Just basically use one of the following:

                  • Bitwarden
                  • KeePass
                  • 1password

                  And stay far the fuck away from LastPass

                • ebits21@lemmy.caEnglish
                  0·
                  2 years ago

                  Oh I do. Used Bitwarden for many years.

                  I actually use keepass for totp codes too.

        • bdonvr@thelemmy.clubEnglish
          0·
          2 years ago

          Also I believe this was achieved through cookie stealing, which 2FA would not have helped

        • Stovetop@lemmy.mlEnglish
          0·
          2 years ago

          More time will definitely be needed. I’m glad they caught it and acted quickly enough to prevent more vandalism from occurring, but until we know how the account was compromised and what else they may have gotten in the process, it’s still a situation to keep an eye on.

    • Max-P@lemmy.max-p.meEnglish
      0·
      2 years ago

      Not a whole lot - you might see some spam being federated from lemmy.world but I’d expect the lemmy.ml and lemmy.world admins will fix it, and them clean it up.

      That’s probably good stress test to figure out how to handle that.

  • RoundSparrow@lemmy.mlBanned
    0·
    2 years ago

    It was cleaned up on the home page, but now back to being defaced as of this comment time.

    Another user on the site confirmed this:

    • G59@lemmy.mlOP
      0·
      2 years ago

      Oh wow again? 10 min ago it was clean! The .world admins are having a productive day lol

      • lemminer@lemmy.ml
        0·
        2 years ago

        Now I’m unable to open lemmy.world, even on liftoff. Mods must have taken it down.

        • LifeCoach5K@lemm.ee
          0·
          2 years ago

          Same here. Seems to be toast through the liftoff app but I haven’t visited the site since the news broke. Liftoff was working an hour ago when it first happened.

    • PlutoniumAcid@feddit.dkEnglish
      0·
      2 years ago

      No biggie. Choose another server and create it there, too. Largest communities will win in the long run.