If you’re just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.
If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.
How?
This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.
Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.
What happens next?
As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you’ll likely see:
Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:
Exactly what happened, when.
The incident response that occurred from instance admins
Information that might have helped resolve the issue sooner
Any issues that prevented successful resolution
What should have been done differently by admins
What should be improved by developers
What can be used to identify the next attack
What tools are needed to identify that information
A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.
A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.
also, I cannot properly login into my lemmy.world account anymore. username/password work, but when I try to upvote it tells me i gotta be logged in. Tried apps and web.
I had the same problem on the liftoff app. Had to delete the account then sign back in and everything worked perfectly again. Personally I also changed my password because it made me feel better.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
A community to talk about the Fediverse and all it’s related services using ActivityPub (Mastodon, Lemmy, KBin, etc).
If you wanted to get help with moderating your own community then head over to [email protected]!
Rules
Posts must be on topic.
Be respectful of others.
Cite the sources used for graphs and other statistics.
also, I cannot properly login into my lemmy.world account anymore. username/password work, but when I try to upvote it tells me i gotta be logged in. Tried apps and web.
Try clearing cookies (or app cache, on app), that will most likely resolve the issue.
sometimes just logging in again works. if you have it set to automatically log in, that happens sometimes.
I had to clear the app cache and local storage before it would work. Cache alone didn’t work.
I had the same problem on the liftoff app. Had to delete the account then sign back in and everything worked perfectly again. Personally I also changed my password because it made me feel better.
For liftoff, you can just add the same .world account again and it’ll work, it worked for me.
Clear cache of the app
Thank you so much! I had the same problem but didn’t think of clearing the cache…
Cheers. Happy to help
For me it was cache and storage. Just cache didn’t work. (Using Liftoff)