The Lemmy.world hack made a good opportunity to explore other instances out there. Found one based in my area. Back in action!

  • wetnoodle@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    21
    arrow-down
    1
    ·
    1 year ago

    ayy nice I made a few different accounts on my first day and have added a few since especially in case of crazy things like this happening😂

  • bev@lemmy.world
    link
    fedilink
    English
    arrow-up
    10
    ·
    1 year ago

    Afaik, unless lemmy.ml had patched the vulnerability like the lemmy.world folks, the instance is susceptible to the vulnerability.

    • AzuleBlade@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      I almost made the rash, uninformed decision to close up shop on lemmy.world and move my community to another instance. Luckily I did some further reading, and yeah, unless whatever other instance I jumped ship to was also patched I would have just been wasting my time since this is a vulnerability in the Lemmy code and affects all instances until the admins apply a bandaid/the code is fixed.

      • Railison
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        It’s possible to move communities to other instances? How’s it work?

        • AzuleBlade@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          ·
          edit-2
          1 year ago

          Not really, unfortunately. You’d have to create the community on a different instance, make a sticky post in the original community redirecting them to the new community, and then lock the community to prevent new posts. If you don’t have a lot of content in the original community, or don’t care about keeping it, you could delete the community after a week or two once people have subscribed to the new community to prevent confusion.

        • T156@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          It isn’t possible just yet, although there are issues on Lemmy’s github for it.

    • towerful@programming.dev
      link
      fedilink
      English
      arrow-up
      7
      ·
      edit-2
      1 year ago

      From what I have read so far…

      XSS injection in custom emojis.
      Essentially, custom emojis used by instances could allow a malicious actor to execute arbitrary code on clients that saw the emoji (within the scope of the website).
      There is speculation about links and other vectors, but those aren’t clear yet. But the successful attacks have been tracked back to emojis.

      The emojis aren’t federated, so it would only affect users of that instance that viewed the emoji during the attack.

      The injected script (as it was being execute as part of the client UI, thus trusted) had access to the client cookies for the instance.
      It would steal the JWT tokens stored in the cookies and send them to a 3rd party site.

      Tokens of Admins were then used by the attackers to deface the sites.

      It’s unclear what user data would have been vulnerable during this time - still being investigated.
      There is a high likelihood that this is a GDPR reportable incident.

      The fix is for admins to delete all custom emojis via the database, then rotate JWT secrets.
      Rotating the secrets invalidates all users JWTs, so everyone has to log in again. This also invalidates the stolen JWTs.

  • Waluigi@feddit.de
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    On that note: does anybody know when or even if lemmy.world will be up again? Right now I’m using an alt account but I’ve got a main one and a community on .world and I couldn’t really find any information on how it’s going over there.