Shit, lemmy world got hacked, click on that Israel will lead you to explicit picture of a bunch of naked old man sucking each other, and also pop’s up lead to porn site.
The linked comment suggests that the entire Lemmy platform is currently vulnerable to the cookie stealing exploit that already happened to several instances.
Now, if only we have automod that could detect code injection in markdown links and tempban offenders…
now I’m hearing that the hack is being spread through direct messages as well.
as this seems to be a javascript hack, all admins logged on through any web ui (even the official one) are advised to not open dm’s from unknown users.
as mobile apps differ from browsers, and shouldn’t execute javascript directly, they should be less affected, but please take caution anyway for the time being.
edit: it seems lemmy.blahaj.zone has been hacked too. the malicious javascript has been detected in custom emojis and community description sidebars, so admins must watch out for new users who signup and immediately start posting custom emojis or opening new communities.
I think it is better to not open it at all (at least in the web browser, mobile apps seem to be okay, but nothing is really certain atm), as the malicious javascript seem to be connected to custom emojis and community descriptions in the sidebar (see my latest edit), so no clicking required.
this is bad. rumour has it this is due to an admin’s json web token being leaked.
so I would advise all admins here not to log into 3rd party web apps (mobile apps should be okay) with their admin accounts, as the web apps usually proxy your requests (hence, they have your token), and they proxy not due to nefarious purposes, but due to some problem with cors (in other words, being forced to proxy your request isn’t really their fault, and once the cors problem is fixed in the lemmy backend, they can stop doing that).
it also has something for invalidating all json web tokens by changing the signing key (all users will need to re-login after doing that), which may be necessary depending on whether the tech team believes any of them (especially any of the admin’s) have been compromised (there is currently no expiry date on the tokens).
Shit, lemmy world got hacked, click on that Israel will lead you to explicit picture of a bunch of naked old man sucking each other, and also pop’s up lead to porn site.
Avoid at all cost.
deleted by creator
Resurgence? Rickroll never dies.
deleted by creator
like we’re ever going to give it up
https://kbin.social/m/[email protected]/t/168524/Lemmy-world-and-another-instance-have-been-compromised#entry-comment-661712
The linked comment suggests that the entire Lemmy platform is currently vulnerable to the cookie stealing exploit that already happened to several instances.
Now, if only we have automod that could detect code injection in markdown links and tempban offenders…
is it the lemon party picture?..feels old.
welcome to pre-rickroll internet.
Ahh, that’s what it called, no wonder it’s somehow familiar.
now I’m hearing that the hack is being spread through direct messages as well.
as this seems to be a javascript hack, all admins logged on through any web ui (even the official one) are advised to not open dm’s from unknown users.
as mobile apps differ from browsers, and shouldn’t execute javascript directly, they should be less affected, but please take caution anyway for the time being.
edit: it seems lemmy.blahaj.zone has been hacked too. the malicious javascript has been detected in custom emojis and community description sidebars, so admins must watch out for new users who signup and immediately start posting custom emojis or opening new communities.
Merely open the dm? Or do we have to click the link for it to happen?
I think it is better to not open it at all (at least in the web browser, mobile apps seem to be okay, but nothing is really certain atm), as the malicious javascript seem to be connected to custom emojis and community descriptions in the sidebar (see my latest edit), so no clicking required.
Alright, got it. Thanks!
damn, i feel like we can check off one success criteria: suddenly so attractive for hacks.
this is bad. rumour has it this is due to an admin’s json web token being leaked.
so I would advise all admins here not to log into 3rd party web apps (mobile apps should be okay) with their admin accounts, as the web apps usually proxy your requests (hence, they have your token), and they proxy not due to nefarious purposes, but due to some problem with cors (in other words, being forced to proxy your request isn’t really their fault, and once the cors problem is fixed in the lemmy backend, they can stop doing that).
Thanks Zen, you’re a lifesaver. Brb pressing the emergency button
Goddammit. The fediverse drama continues.
Btw admins it’s best that we defederate for the time being.
(URGENT) Lemmy has an XSS vulnerability in the tagline
https://github.com/LemmyNet/lemmy-ui/issues/1895 has more information on mitigations, which may not be necessary if no custom emojis were added.
it also has something for invalidating all json web tokens by changing the signing key (all users will need to re-login after doing that), which may be necessary depending on whether the tech team believes any of them (especially any of the admin’s) have been compromised (there is currently no expiry date on the tokens).
#lemmyworldhacked #fediversedrama
Thanks, i’m giving it a read but i’m not coding literate so may need some time to parse 😂