Hi all,
If you’re just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.
If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.
How?
This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.
Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.
What happens next?
As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you’ll likely see:
- Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:
- Exactly what happened, when.
- The incident response that occurred from instance admins
- Information that might have helped resolve the issue sooner
- Any issues that prevented successful resolution
- What should have been done differently by admins
- What should be improved by developers
- What can be used to identify the next attack
- What tools are needed to identify that information
-
A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.
-
A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.
How do I contact my instance admin?
I went ahead and logged out and back in on my own, but I was not prompted to do so by Lemmy and I don’t know enough about this stuff to say whether or not doing it on my own would’ve helped. I’m still pretty overwhelmed trying to figure this site out, so I apologize if this is a dumb question, just want to make sure I’m doing what I can to protect my own privacy.
I don’t want to fall for the millennial version of a Nigerian prince scam, lol.
I wonder start instances required logins. I had to relog on desktop world acct, but my .ee account on mobile didn’t need to.
I heard lemm.ee wasn’t vulnerable, so logging users out shouldn’t be necessary. To be vulnerable there would need to be custom emotes defined on the local instance by the admins, so I’m guessing they had none.
You’re on the lemmy.world instance, so you can reach the admins by emailing [email protected], or posting in the support forum [email protected]
Now to answer whether there’s a difference between being promoted and doing it yourself - In this case, it’s suspected that session tokens were compromised. You know how when you enter some events, they vet you/your ticket once at the door and then put a stamp on your hand? If you go out and want to get back in, you don’t have to do the whole verification song and dance again, just show them your stamp? Well, that’s pretty much what a session token is - Lemmy vets your password once when you log in, and gives an unique session token to whatever browser or app you used to log in. That way, when you reopen Lemmy, you don’t have to enter your password again.
Now that token is compromised, you have to assume a hacker has your unique token. When you logged yourself back in, Lemmy did the whole validation process again and gave your browser/app a new, unique session token - that’s just how logging in works. But the important question is, did it invalidate the old session token when you logged out? Otherwise the hacker can still show the old token and pretend to be you.
Now if your browser/app prompted you to log-in today, you can be sure that your browser/app tried to get into Lemmy and was denied access. That means you can be sure your old stamp/token is now invalid. Logging out and in yourself doesn’t give you the same guarantee - you will have to check Lemmy code (or run some experiments) to know if logout does actually invalidate the old token. I haven’t validated Lemmy’s code, but I will say most half decent software will invalidate your token when you log out. If you want an extra layer of protection, change your password as well - even the software devs that forget to invalidate tokens on logout usually remember to invalidate them on password changes.