Hi all,
If you’re just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.
If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.
How?
This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.
Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.
What happens next?
As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you’ll likely see:
- Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:
- Exactly what happened, when.
- The incident response that occurred from instance admins
- Information that might have helped resolve the issue sooner
- Any issues that prevented successful resolution
- What should have been done differently by admins
- What should be improved by developers
- What can be used to identify the next attack
- What tools are needed to identify that information
-
A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.
-
A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.
Having recently migrated from Reddit (and kept up with commercial social media hacks) I’m used to Nothing To See Here! We totally didn’t store your personal information in plaintext for hackers to snatch. Oh and maybe please change your passwords. All Part Of The Show!
So, by comparison, the response here is downright heartwarming.
Whoops! Reddit spazzed out and couldn’t send your post because it hurts spez’s feelings!
A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.
You don’t need to pay money. You just need to listen to the recommendations already made by free tools.
Here, fix this shit first and then worry about a professional audit later.
This post is weird. You’re typing like you’re in charge of things, but you’re apparently not.
It’s one thing to show some initiative, but you’re literally demanding a full report like the Lemmy devs work for you. You sound like someone who does this kind of thing for a living and felt the need to flex. Because otherwise, what the hell are you even doing?
Setting neurotically-specific demands for the developers makes sense if you represent a big instance or something, but you’re literally just a dude. You could have framed this entire post in a different way and gotten away with it. Right now, it’s creepy to anybody who actually reads the entire thing.
These aren’t demands, but I can definitely see how they can come off that way. These are industry standard post cybersecurity incident review questions by defined by NIST (NIST SP 800-61 Rev 2 Section 3.4.1) slightly rephrased.
also, I cannot properly login into my lemmy.world account anymore. username/password work, but when I try to upvote it tells me i gotta be logged in. Tried apps and web.
Clear cache of the app
For me it was cache and storage. Just cache didn’t work. (Using Liftoff)
Thank you so much! I had the same problem but didn’t think of clearing the cache…
Cheers. Happy to help
I had the same problem on the liftoff app. Had to delete the account then sign back in and everything worked perfectly again. Personally I also changed my password because it made me feel better.
I had to clear the app cache and local storage before it would work. Cache alone didn’t work.
Try clearing cookies (or app cache, on app), that will most likely resolve the issue.
How do I contact my instance admin?
I went ahead and logged out and back in on my own, but I was not prompted to do so by Lemmy and I don’t know enough about this stuff to say whether or not doing it on my own would’ve helped. I’m still pretty overwhelmed trying to figure this site out, so I apologize if this is a dumb question, just want to make sure I’m doing what I can to protect my own privacy.
I don’t want to fall for the millennial version of a Nigerian prince scam, lol.
You’re on the lemmy.world instance, so you can reach the admins by emailing info@lemmy.world, or posting in the support forum !support@lemmy.world
Now to answer whether there’s a difference between being promoted and doing it yourself - In this case, it’s suspected that session tokens were compromised. You know how when you enter some events, they vet you/your ticket once at the door and then put a stamp on your hand? If you go out and want to get back in, you don’t have to do the whole verification song and dance again, just show them your stamp? Well, that’s pretty much what a session token is - Lemmy vets your password once when you log in, and gives an unique session token to whatever browser or app you used to log in. That way, when you reopen Lemmy, you don’t have to enter your password again.
Now that token is compromised, you have to assume a hacker has your unique token. When you logged yourself back in, Lemmy did the whole validation process again and gave your browser/app a new, unique session token - that’s just how logging in works. But the important question is, did it invalidate the old session token when you logged out? Otherwise the hacker can still show the old token and pretend to be you.
Now if your browser/app prompted you to log-in today, you can be sure that your browser/app tried to get into Lemmy and was denied access. That means you can be sure your old stamp/token is now invalid. Logging out and in yourself doesn’t give you the same guarantee - you will have to check Lemmy code (or run some experiments) to know if logout does actually invalidate the old token. I haven’t validated Lemmy’s code, but I will say most half decent software will invalidate your token when you log out. If you want an extra layer of protection, change your password as well - even the software devs that forget to invalidate tokens on logout usually remember to invalidate them on password changes.
I wonder which instances required logins. I had to relog into my .world account, but my .ee account was still logged in.
I heard lemm.ee wasn’t vulnerable, so logging users out shouldn’t be necessary. To be vulnerable there would need to be custom emotes defined on the local instance by the admins, so I’m guessing they had none.
XSS, classic
Thanks for your hard work, fuck the trolls that always have to poke holes in shit
Honestly, I see it as a win.
The people that did this didn’t really act out in a coordinated attack. They were just kind of playing around, redirecting to lemonparty, changing page elements.
It could have been a lot worse. The site could have been redirecting to malicious websites, downloading trojans, doing a lot of bad things. Instead, we got direct attention to the security vulnerabilities in question, and they’re being worked on and patched out relatively quickly. Helps that a lot of those on these communities are focused in programming and cybersecurity.
That’s fair, I was a little harsh. Not all hackers are looking to cause damage!
Agree completely. In the grand scheme of things the damage that appears to have happened here is small potatoes, but it brought attention to the vulnerability so it was patched quickly. Going forward now, the authors and contributors to the project might be a bit more focused on hardening the software against these types of vulnerabilities. Pen testing is invaluable on wide user-base internet accessible platforms like this because it makes better, more secure software. Unfortunately this breech wasn’t under the “ethical pen testing” umbrella but it sure as hell brought the vulnerability to the mindshare of everyone with a stake in it, so I view it as a net win.
Yes, exactly. This could’ve been way worse.
If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.
It could get VERY, VERY expensive… depends on code complexity.
Not at this stage.
Lemmy grew too fast, got many more eyes.
Step 1 is getting a security focus group selected from the people who contribute code to lemmy.Just like the admins and coders volonteer their time, security specialists will too, money might be needed, but that is not in the the first steps.
Agreed, this is wise.
Yeah, specifically why I mentioned “affordable”.
is there a mailing list or anything like that? i would like to help contribute to security hardening efforts
There’s this dev chatroom https://matrix.to/#/#lemmydev:matrix.org
- Set up a fake Nazi lemmy
- Have it online during the next Chaos Communication Congress
- ???
- 50 CVEs.
- Be Lemmy Devs
- Loudly Claim Lemmy is Bulletproof and unhackable
- ???
- 50 CVEs
deleted by creator
The way the hack was utilized is honest very creative and interesting;
That’s often the case with exploits.
deleted by creator
Sure. Not sure how that’s relevant though?
In general, finding an exploit requires looking for little tiny details that could exist in, really, any area of a given system; looking for a bug, and then exploiting that bug by understanding how input data can be used to create a deterministic chain of events.
This almost always requires thinking outside of the box.
There are people who are also paid to find these before malicious actors do.
It’s always going to be creative in some way, at least in the beginning.
It’s like when people first discover Quake’s fast inverse square root. Sure, the first time around it seems genius. In reality, code like that is actually everywhere, and there is a somewhat trivial aspect to optimizing those kinds of problems.
No, Bobby Tables is really not that creative at all. It is the most basic, entry-level exploit.
This incident made me realize not to use an admin account for my primary lemmy account in my personal instance. I setup another account for instance admin purpose (with 2FA enabled) and keep it logged out, then remove my primary account from the instance admin list.
This is a good mindset in general, when working in AWS you are not supposed to use your root account unless it’s absolutely necessary even if you are the only user. Hosting a Lemmy instance should be no different.
deleted by creator
So if you dont have to resign-in?
Timception you should contact the admin for your lemmy server. If you didn’t need to log back in, your server likely was not fixed. This means someone could hack it and steal the session cookies to impersonate server members.
It could also be that they never implemented custom emoticons, which are what caused the security issue. Even still, I would recommend confirming with your server admin.
I was able to scroll through content, but had to relogin to upvote. However, today I was forced to re-login since I entered the Memmy app. So I guess, all good? Thx for the tips.
I haven’t been able to change my password on Lemmy.world. When I click save, nothing happens and the password doesn’t update.
That’s probably something someone wants to look into.
Was lemmy.ml affected ?
Does this affect kbin.social? I know we federate with Lemmy, but I think there are also code differences.
kbin is a completely different piece of software so I’d be surprised if there were many code similarities.
Still, that could just mean that there are kbin-specific hacks lurking in the future.
It’s a completely different codebase. Lemmy is written in Rust, while KBin is written in PHP. At least for now, there hasn’t been any issue this bad.
In the end, Magic Quotes will save us all.
Thanks for clarifying that! I didn’t have to sign in again, but my account is on kbin.social, so I guess that’s why.
No problem, fellow KBinaut!
Is the sudden unannounced disappearance of Vlemmy related to this ? I had my main account there and it just disappeared
The most probable theory is that the server owner found illegal federated content on their server and decided to nuke the place entirely.
Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.
Probably because the hackers used some http request to get the data and didn’t want to wade through thousands of rows of JWT strings.
