lemmy.world and lemmy.blahaj.zone got hacked, admins in sopuli.xyz should enforce 2fa for admins and possibly disable/ look into possible injections from the community sidebar
lemmy.world and lemmy.blahaj.zone got hacked, admins in sopuli.xyz should enforce 2fa for admins and possibly disable/ look into possible injections from the community sidebar
18 Comments
QuentinCallaghan@sopuli.xyz · 19 pts · 3y
I just enabled 2-factor authentication because of this. Script-kiddies are not gonna capture this instance!
ananas@sopuli.xyz · 9 pts · 3y
It's highly unlikely 2FA is enough to mitigate this kind of an attack. It's a security vulnerability in lemmy itself, and they are stealing your access token instead of trying to log in as you.
edit: People, please, no reason to downvote admin ACKs. Just means they've at least read the message, after that, it's their instance and they'll do as they see fit.
QuentinCallaghan@sopuli.xyz · 6 pts · 3y
OK.
Nowyn@sopuli.xyz · 3 pts · 3y
Did Sopuli have any custom emojis enabled? Based on what I read about the hack the vulnerability was linked with those as detailed here.
QuentinCallaghan@sopuli.xyz · 3 pts · 3y
Nope, there are no custom emojis.
Nowyn@sopuli.xyz · 3 pts · 3y
Thank you for answering!
QuentinCallaghan@sopuli.xyz · 1 pts · 3y
Once this vulnerability gets fixed, I could make a thread to !meta@sopuli.xyz about suggesting custom emojis for Sopuli.
018118055@sopuli.xyz · 7 pts · 3y
If they're stealing sessions that might not be enough. I saw some other mitigations discussed elsewhere.
fuser@quex.cc · 2 pts · 3y
Create new accounts & make them instance admin instead (they have to make a local comment to be made admin). Then remove your "browsing" accounts from admin group until patched.
Nuuskis@sopuli.xyz · 9 pts · 3y
So there's no risks for regular users if they get hacked? Asking for learning purposes.
allywilson@sopuli.xyz · 4 pts · 3y
Depends on the exploit really, but if they have admin access they have access to the info in your profile, so probably know your email address. I don't know enough about the backend infra to be sure, but I doubt Lemmy stores passwords in plain text in DBs, etc. and although they have admin access, they probably don't have access to the DB (again, a bit unfamiliar with all possibilities, but typically the DB is on a separate container/host/service independant of the frontend).
Does anyone have a link for details on the hack/exploit?
fuser@quex.cc · 4 pts · 3y
https://github.com/LemmyNet/lemmy-ui/pull/1897
Stealing instance admin auth tokens via cross site injection into custom emoji title.
Nuuskis@sopuli.xyz · 1 pts · 3y
Thanks for the explanation!