While I was asleep, apparently the site was hacked. Luckily, (big) part of the
lemmy.world team is in US, and some early birds in EU also helped mitigate this.
As I am told, this was the issue: - There is an vulnerability which was
exploited - Several people had their JWT cookies leaked, including at least one
admin - Attackers started changing site settings and posting fake announcements
etc Our mitigations: - We removed the vulnerability - Deleted all comments and
private messages that contained the exploit - Rotated JWT secret which
invalidated all existing cookies The vulnerability will be fixed by the Lemmy
devs. Because not all instances are aware, we will not go into detail on the
vulnerability yet. Many thanks for all that helped, and sorry for any
inconvenience caused! Update While we believe the admins accounts were what they
were after, it could be that other users accounts were compromised. Your cookie
could have been ‘stolen’ and the hacker could have had access to your account,
creating posts and comments under your name, and accessing/changing your
settings (which shows your e-mail). For this, you would have had to be using
lemmy.world at that time, and load a page that had the vulnerability in it.
A number of Lemmy instances have been hacked overnight.
Some may remain inaccessible until they have been secured and restarted.
As a safety precaution logged-on sessions on many servers have been cancelled and you are required to logon again.
Unfortunately, the only way I could find to do this in Liftoff! is by going to Settings > Accounts and deleting each local account by long pressing on it, and then create it again.
All your posts, comments and bookmarks should be preserved during this process.
Please see the linked posts for further details as they emerge.
Thanks all, and please bear with us as this gets resolved.
This makes me shudder from my time running forums.
OOB vbulletin was notoriously bad at fending off sql injections, and required CONSTANT monitoring, tweaking, or disabling of basic features to keep the Syrian Liberation Army (as one particular example) from pwning an admin account.
This makes me shudder from my time running forums.
OOB vbulletin was notoriously bad at fending off sql injections, and required CONSTANT monitoring, tweaking, or disabling of basic features to keep the Syrian Liberation Army (as one particular example) from pwning an admin account.
Also, and covered in detail, JWT should not be your default for sessions.