Sopuli's Default Community

1283 readers

1 users here now

Community for all jibber-jabber. As this is a hard-coded community for every instance, we may get this doing something useful.

Simple test posts to !test_community@sopuli.xyz

Meta-discussion regarding the instance and support in problem situations !meta@sopuli.xyz

Yhteisö kaikenlaiselle pälätykselle. Koska tämä on kovakoodattu yhteisö jokaiselle instanssille, voimme tehdä tällä ehkä jotain hyödyllistä.

Yksinkertaiset testiviestit mielellään !test_community@sopuli.xyz

Instanssia koskeva metakeskustelu ja tuki ongelmatilanteissa !meta@sopuli.xyz

founded 4 years ago

MODERATORS

QuentinCallaghan@sopuli.xyz

tkk13909@sopuli.xyz

multiple lemmy instances are going down to a js injection or admin password hack (sopuli.xyz)

submitted 2 years ago by wetnoodle@sopuli.xyz to c/main@sopuli.xyz

18 comments fedilink hide all child comments

lemmy.world and lemmy.blahaj.zone got hacked, admins in sopuli.xyz should enforce 2fa for admins and possibly disable/ look into possible injections from the community sidebar

you are viewing a single comment's thread
view the rest of the comments

[–] QuentinCallaghan@sopuli.xyz 19 points 2 years ago* (last edited 2 years ago) (2 children)

I just enabled 2-factor authentication because of this. Script-kiddies are not gonna capture this instance!

[–] ananas@sopuli.xyz 9 points 2 years ago* (last edited 2 years ago) (1 children)

It's highly unlikely 2FA is enough to mitigate this kind of an attack. It's a security vulnerability in lemmy itself, and they are stealing your access token instead of trying to log in as you.

edit: People, please, no reason to downvote admin ACKs. Just means they've at least read the message, after that, it's their instance and they'll do as they see fit.

[–] QuentinCallaghan@sopuli.xyz 6 points 2 years ago (1 children)

OK.

[–] Nowyn@sopuli.xyz 3 points 2 years ago (1 children)

Did Sopuli have any custom emojis enabled? Based on what I read about the hack the vulnerability was linked with those as detailed here.

[–] QuentinCallaghan@sopuli.xyz 3 points 2 years ago (1 children)

Nope, there are no custom emojis.

[–] Nowyn@sopuli.xyz 3 points 2 years ago (1 children)

Thank you for answering!

[–] QuentinCallaghan@sopuli.xyz 1 points 2 years ago

Once this vulnerability gets fixed, I could make a thread to !meta@sopuli.xyz about suggesting custom emojis for Sopuli.

[–] 018118055@sopuli.xyz 7 points 2 years ago (1 children)

If they're stealing sessions that might not be enough. I saw some other mitigations discussed elsewhere.

[–] fuser@quex.cc 2 points 2 years ago* (last edited 2 years ago)

Create new accounts & make them instance admin instead (they have to make a local comment to be made admin). Then remove your "browsing" accounts from admin group until patched.