Lemmy just had its first major hack. What happens next: (lemmy.world)

submitted 1 year ago* (last edited 1 year ago) by rcmaehl@lemmy.world to c/fediverse@lemmy.world

39 comments fedilink hide all child comments

Hi all,

If you're just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

How?

This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.

Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.

What happens next?

As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you'll likely see:

Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:

Exactly what happened, when.
The incident response that occurred from instance admins
Information that might have helped resolve the issue sooner
Any issues that prevented successful resolution
What should have been done differently by admins
What should be improved by developers
What can be used to identify the next attack
What tools are needed to identify that information

A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.
A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I'll look into crowdfunding this cost.

top 39 comments

sorted by: hot top controversial new old

[-] kep@lemmy.world 12 points 1 year ago

This post is weird. You're typing like you're in charge of things, but you're apparently not.

It's one thing to show some initiative, but you're literally demanding a full report like the Lemmy devs work for you. You sound like someone who does this kind of thing for a living and felt the need to flex. Because otherwise, what the hell are you even doing?

Setting neurotically-specific demands for the developers makes sense if you represent a big instance or something, but you're literally just a dude. You could have framed this entire post in a different way and gotten away with it. Right now, it's creepy to anybody who actually reads the entire thing.

[-] rcmaehl@lemmy.world 2 points 1 year ago* (last edited 1 year ago)

These aren't demands, but I can definitely see how they can come off that way. These are industry standard post cybersecurity incident review questions by defined by NIST (NIST SP 800-61 Rev 2 Section 3.4.1) slightly rephrased.

[-] redcalcium@c.calciumlabs.com 9 points 1 year ago* (last edited 1 year ago)

This incident made me realize not to use an admin account for my primary lemmy account in my personal instance. I setup another account for instance admin purpose (with 2FA enabled) and keep it logged out, then remove my primary account from the instance admin list.

[-] Renacles@lemmy.world 5 points 1 year ago

This is a good mindset in general, when working in AWS you are not supposed to use your root account unless it's absolutely necessary even if you are the only user. Hosting a Lemmy instance should be no different.

[-] Vilian@lemmy.ca 2 points 1 year ago

most, if not every, linux distro work that way

[-] BarterClub@sh.itjust.works 1 points 1 year ago

Yup. Basics of running a server for anything. Never use your admin account and make a default backup with 2 factor.

[-] Crackhappy@lemmy.world 0 points 1 year ago

I work with 2 factor, Oath, SAML, etc. all the time for work, and for the life of me I can't get it working properly with Lemmy.

[-] Notorious@lemm.ee 1 points 1 year ago

Lemmy decided to go with SHA256 for TOTP seed. This is a very odd move since many 2FA apps don’t support SHA256. I actually had to write a quick python script to spit out my 2FA code since Bitwarden doesn’t support it. Hopefully either Lemmy will change to SHA-1 or Bitwarden will start to support SHA256 seeds.

[-] redcalcium@c.calciumlabs.com 1 points 1 year ago* (last edited 1 year ago)

Wait, I use bitwarden and it works just fine. And yes, it's using SHA256.

Screenshot:

[-] Trapping5341@lemmy.world 0 points 1 year ago

wait wait wait. how did you get lemmy 2FA into bitwarden. I can only get it to set up in authy or google auth

[-] redcalcium@c.calciumlabs.com 0 points 1 year ago

You'll need to either subscribe to bitwarden premium ($10 / year), or deploy vaultwarden in your own server and have your bitwarden extension/app use that vaultwarden server instead of the official server.

[-] Trapping5341@lemmy.world 0 points 1 year ago

Yeah I have premium and every account I have that offers 2fa is set up but Lemmy will only let me set it up in authy or Google auth. It won't give bitwarden as an option or give me the code to manually add it to bitwarden.

[-] redcalcium@c.calciumlabs.com 1 points 1 year ago

Just right click at the 2fa button and select "copy link", then paste the link into bitwarden TOTP field. The link you copied should already be in the format otpauth://totp/xxxx which will be recognized by bitwarden.

[-] Uriel238@lemmy.fmhy.ml 7 points 1 year ago

Having recently migrated from Reddit (and kept up with commercial social media hacks) I'm used to Nothing To See Here! We totally didn't store your personal information in plaintext for hackers to snatch. Oh and maybe please change your passwords. All Part Of The Show!

So, by comparison, the response here is downright heartwarming.

[-] Alkider@lemmy.world 2 points 1 year ago

Whoops! Reddit spazzed out and couldn't send your post because it hurts spez's feelings!

[-] p03locke@lemmy.dbzer0.com 7 points 1 year ago

A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.

You don't need to pay money. You just need to listen to the recommendations already made by free tools.

Here, fix this shit first and then worry about a professional audit later.

[-] 0x4E4F@sh.itjust.works 1 points 1 year ago

If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.

It could get VERY, VERY expensive... depends on code complexity.

[-] static@kbin.social 1 points 1 year ago

Not at this stage.
Lemmy grew too fast, got many more eyes.
Step 1 is getting a security focus group selected from the people who contribute code to lemmy.

Just like the admins and coders volonteer their time, security specialists will too, money might be needed, but that is not in the the first steps.

[-] Dreamer_joy@lemmy.ml 1 points 1 year ago

Was lemmy.ml affected ?

[-] Pekka@feddit.nl 2 points 1 year ago

Only Lemmy instances with custom emoticons were affected based on the Recap of the Lemmy XSS incident. So if Lemmy.ml doesn't have these it should not have been affected.

[-] dan1101@lemmy.world 1 points 1 year ago

I think generally the less flashy features (pun intended) the better. Text and links (and well sanitized) is all we need.

[-] Wintermute@lemmy.villa-straylight.social 1 points 1 year ago

I agree. Sadly it seems the rest of the world does not. Hopefully as Lemmy matures we can get to a point where features are not pushed put half-baked because there aren't enough people willing and able to give thorough code reviews.

[-] ZuckerbergIsCancer@lemmy.ml 1 points 1 year ago

Friendly remind that Lemmy.world is considering federating with Meta while Lemmy.ml will not.

I would strongly suggesting ditching Lemmy.world for Lemmy.ml before they can even get started with that stupidity.

[-] choroalp@programming.dev 1 points 1 year ago

XSS, Seriously?

[-] rcmaehl@lemmy.world 1 points 1 year ago* (last edited 1 year ago)

To add context to this. What I've been told is that a community running on a lemmy fork with 5 digit users had used this code for a while and backported(?) the code upstream when they federated back. I guessing there was an assumption of safety as they had been using the custom emojis code for quite a while without it being exploited.

[-] FightMilk@lemmy.world -1 points 1 year ago

Yeah it'll be hard to regain my trust after this one. I mean I'll still use Lemmy but for now I'll assume mine or any other account could be hacked at any time and act accordingly. This is a really amateur mistake even by FOSS standards.

[-] phileashog@sh.itjust.works 0 points 1 year ago

XSS, classic

Thanks for your hard work, fuck the trolls that always have to poke holes in shit

[-] hackitfast@lemmy.world 2 points 1 year ago

Honestly, I see it as a win.

The people that did this didn't really act out in a coordinated attack. They were just kind of playing around, redirecting to lemonparty, changing page elements.

It could have been a lot worse. The site could have been redirecting to malicious websites, downloading trojans, doing a lot of bad things. Instead, we got direct attention to the security vulnerabilities in question, and they're being worked on and patched out relatively quickly. Helps that a lot of those on these communities are focused in programming and cybersecurity.

[-] phileashog@sh.itjust.works 1 points 1 year ago

That's fair, I was a little harsh. Not all hackers are looking to cause damage!

[-] theangryseal@lemmy.world 0 points 1 year ago

I haven’t been able to change my password on Lemmy.world. When I click save, nothing happens and the password doesn’t update.

That’s probably something someone wants to look into.

[-] ijeff@lemdro.id 1 points 1 year ago

Try clearing your browser data and cookies first.

[-] theangryseal@lemmy.world 1 points 1 year ago

I specifically cleared lemmy.world data and that did it.

Thank you.

[-] monerobull@monero.town 0 points 1 year ago

Good thing we don't have custom emojis on monero.town and the admin account isn't used for things outside of the local community :D

[-] I_AnoN_I@lemmy.world -3 points 1 year ago

Good opsec

[-] where_am_i@sh.itjust.works 0 points 1 year ago

also, I cannot properly login into my lemmy.world account anymore. username/password work, but when I try to upvote it tells me i gotta be logged in. Tried apps and web.