Hi all,

If you’re just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

How?

This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.

Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.

What happens next?

As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you’ll likely see:

  1. Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:
  • Exactly what happened, when.
  • The incident response that occurred from instance admins
  • Information that might have helped resolve the issue sooner
  • Any issues that prevented successful resolution
  • What should have been done differently by admins
  • What should be improved by developers
  • What can be used to identify the next attack
  • What tools are needed to identify that information

  1. A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.

  2. A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I’ll look into crowdfunding this cost.

  • ZuckerbergIsCancer@lemmy.mlEnglish
    1893·
    1 year ago

    Friendly remind that Lemmy.world is considering federating with Meta while Lemmy.ml will not.

    I would strongly suggesting ditching Lemmy.world for Lemmy.ml before they can even get started with that stupidity.

    • simple@lemmy.worldEnglish
      573·
      1 year ago

      Dumb take. Lemmy.world devs simply said it’s not likely Threads will federate with Lemmy anytime soon anyways, and they’ll make a decision when there is actually a decision to be made.

      • ZuckerbergIsCancer@lemmy.mlEnglish
        1157·
        1 year ago

        “Dumb take” lol

        The “dumb take” is defaulting to federate with Threads rather than NOT federating with Threads.

        The only people defending this stupidity are .world users.

        Their “wait and see” approach should be “don’t federate until we know it’s safe”.

        They’ve taken the opposite (foolish) route.

        • simple@lemmy.worldEnglish
          403·
          1 year ago

          I’ve made many comments saying why we should defederate with Threads but I still agree with the admins that there’s no point in doing a knee-jerk reaction on a threat that

          A) won’t happen until at least a few months later

          B) likely won’t federate with Lemmy anyways

          C) isn’t actually a threat to Lemmy, but could pose a threat to microblogging websites like Mastodon

          So yeah, waiting and seeing isn’t stupid.

          • ZuckerbergIsCancer@lemmy.mlEnglish
            444·
            1 year ago

            “Wait and see” is fine.

            Federating in the meantime is not.

            Stop trying to dance around the heart of the issue.

            • simple@lemmy.worldEnglish
              361·
              1 year ago

              Federating in the meantime is not.

              Dude, Threads isn’t federating with anything right now. That’s the point, we’re not federated so there’s no reason to make a decision on something that won’t happen yet.

                • ElectroNeutrino@lemmy.worldEnglish
                  17·
                  1 year ago

                  https://lemmy.world/post/1274909

                  Conclusion:

                  From the points discussed above, the possible lack of moderation alone justifies considering defederation from Threads. However, it remains to be seen how Meta will handle moderation on such a large scale. Additionally, the inability of individuals to block an instance means we have to do what is best for the community.

                  Where does it say in the admin post that they are default federating with Threads?

                • TheInsane42@lemmy.worldEnglish
                  7·
                  1 year ago

                  They haven’t made a decision, as it’s no issue as there is no federation to threads and won’t be for the forseeable future.

                  Making a fuss about it now is as usefull as making a fuss over the sun dying in several million years.

    • mrmanager@lemmy.todayEnglish
      241·
      1 year ago

      Maybe ditching Lemmy.world makes sense but signing up on Lemmy.ml doesn’t. Pick smaller instances and spread out guys. That’s the entire point. :)

      It’s a bit funny that 100k users signed up on the same instance… :)

    • RxBrad@lemmy.worldEnglish
      192·
      1 year ago

      “Ma’am… this is an Arby’s.”

      Threads is not a Lemmy issue. Mastodon is where the concern lies.

    • RCMaehl [Any]@lemmy.worldOPEnglish
      111·
      1 year ago

      While this is definitely a discussion to be had (I’ve created a few accounts on different instances). Posting that here is just adding onto the drama.

      • ZuckerbergIsCancer@lemmy.mlEnglish
        227·
        1 year ago

        Not sure how you view it that way.

        It’s just good advice for people who want to stay the hell away from a company like Meta that was willing to hand over private data to assist authorities in arresting a woman for exercising her reproductive rights.

        Really not thrilled with the Lemmy.world users trying to downplay just how ridiculous the idea of federating with Meta is.

        Is it possible to block .world entirely yet?

        • Mereo@lemmy.caEnglish
          13·
          1 year ago

          Look, Lemmy.world takes the rational way where it says there is no use to panic. Let’s be rational and analyze the situation rationally and go from there.

          I support Lemmy.world. Let’s see how the situation develops and let’s make a rational decision with cool heads.

    • CodeMonkeyDance@lemmy.worldEnglish
      13·
      1 year ago

      I ran screaming from FB. Like, hair on fire running. That place is a roiling pot of piss. I would 100% not interact with ANY instance that has federated with them. They are a cancer that will infect this next big thing

    • notreally@lemm.eeEnglish
      59·
      1 year ago

      yeah, Lemmy is instilling a ton of confidence when instances disappear overnight (vlemmy) and others get all their data hacked and close off all communication with the largest user base that will exist in the fediverse. Y’all really about to make people go back to Reddit