this post was submitted on 10 Jul 2023

225 points (100.0% liked)

Blahaj Lemmy Meta

2304 readers

2 users here now

Blåhaj Lemmy is a Lemmy instance attached to blahaj.zone. This is a group for questions or discussions relevant to either instance.

founded 2 years ago

MODERATORS

[email protected]

225

Blåhaj Lemmy hacked (lemmy.blahaj.zone)

submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

53 comments fedilink hide all child comments

Hi everyone.

Lemmy had an XSS vulnerability and we were one of the instances attacked through this vulnerability. We had our homepage replaced by a youtube video.

The lemmy devs were quick to create a PR for this issue and we have patched our instance to fix it,

Also while I do not believe any login tokens were compromised, we have taken the additional measure of rotating our secret key, so everyone will have to login to the site again as your existing credentials will no longer be valid.

If login fails to work properly, you may have to clear your cookies for the site... it seems to get confused about whether you're logged in or not.

Sorry that this happened, if you have any questions please contact @[email protected] or myself.

blobcat, heart

top 48 comments

sorted by: hot top controversial new old

[–] [email protected] 51 points 1 year ago

That's gotta be what, 4 hours from discovery to patch?

Impressive work from everyone nya :)

I love FOSS

[–] [email protected] 20 points 1 year ago (1 children)

Damn that was quick! I didn't even notice LOL if it wasn't for this post I would have thought that my account got logged off just for a bug :p

Thank you and the lemmy devs for being so quick!! blobcat, heart

out of curiosity, what was the youtube video?

[–] [email protected] 7 points 1 year ago (2 children)

By the way, I don't know if this is related but I have an issue now after this

I can log in using the web app but in Jerboa when I log in I can see Im logged in but I when I try to do something like commenting it tells me I'm not, then after reopening the app I'm fully logged off again, has this happened to someone else?

[–] Still 10 points 1 year ago (1 children)

you gotta sign out the master key used to authenticate your session was cycled, so you need to get a new one, jerboa gets confused cuz it already has one but is no longer valid

[–] [email protected] 1 points 1 year ago

Ohhh it works now! Since it said I wasn't logged in I thought that meant I wasn't logged in but apparently not :p

[–] [email protected] 7 points 1 year ago

The master encryption key was rotated, meaning your current login creds/tokens are invalid and you have to login again.

[–] [email protected] 16 points 1 year ago (1 children)

Yea how do I know you're not the hacker that's still in control? 🤔

[–] [email protected] 29 points 1 year ago* (last edited 1 year ago) (1 children)

How do you know I haven't always been the hacker who's in control? :D

[–] [email protected] 9 points 1 year ago* (last edited 1 year ago)

😲 Oh no... Lol, that'd be funny tho

[–] [email protected] 14 points 1 year ago

had to remove cookies from lemmy.blahaj.zonw for my login to work

[–] [email protected] 11 points 1 year ago (1 children)

I can no longer access my blahaj account, which sucks because ive done alot on it. Im not sure if its because Blahaj is down or my account is gone, I just cant get into my account anymore.

[–] [email protected] 10 points 1 year ago (3 children)

Yeah I cant even access the site anymore, even if I reset cookies.

[–] [email protected] 5 points 1 year ago

I'm having the same issue. I can't access the website at all and I definitely cannot login on my app (Connect). I've cleared my cookies several times and tried to access the page to no avail.

[–] [email protected] 4 points 1 year ago* (last edited 1 year ago) (1 children)

I'm facing the same issue. I tried disabling JS by setting Blåhaj Lemmy to "untrusted" on NoScript, and this seemed to work the first time I tried it, but not any subsequent times.

The message I see is, "There was an error on the server. Try refreshing your browser. If that doesn't work, come back at a later time. If the problem persists, you can seek help in the Lemmy support community or Lemmy Matrix room."

Opening up the split console in Firefox Web Developer Tools, I see "500 Internal Server Error". Comparing and contrasting with lemmy.world, I don't see any other meaningful difference. I've also tried visiting Blåhaj Lemmy on Google Chrome on my Android phone, where I don't have any extensions, but that gave me the same error message.

[–] [email protected] 6 points 1 year ago (2 children)

@[email protected] @[email protected]

This has been fixed now! There was an error importing an emoji that took the site down right after we went to bed.

[–] [email protected] 3 points 1 year ago

Hooray! Thank you for your service.

[–] [email protected] 2 points 1 year ago

That’s always how it goes right? Thanks for your hard work :)

[–] [email protected] 2 points 1 year ago

All i get is an unthemed lemmy error page.

[–] [email protected] 10 points 1 year ago

Yeah thanks for being on top of things! That was a really quick fix by everybody. Glad to have this place back!

[–] [email protected] 10 points 1 year ago

Thanks for the reactivity and the transparency crabrave

[–] [email protected] 10 points 1 year ago

@supakaity

Fittingly, given that the hack seemed to be through the custom emoji interface (?), this thread has some wonderful emoji action!!

[–] [email protected] 9 points 1 year ago

Kept on having issues today but was finally able to log in. Glad to be back :)

[–] [email protected] 8 points 1 year ago (3 children)

What sort of YouTube video replaced the home page? I'm assuming it was some sort of shock/racist content.

[–] [email protected] 7 points 1 year ago

Not sure. I didn't load it.

[–] [email protected] 4 points 1 year ago (1 children)

Puneet Superstar - rap god

[–] [email protected] 8 points 1 year ago (1 children)

Fairly harmless choice by the hacker, though could be a bit of a jumpscare if you've allowed autoplay for blåhaj zone

[–] [email protected] 6 points 1 year ago

YouTube doesn't allow you to embed music videos, so it wouldn't play unless you clicked on it lmao.

[–] [email protected] 3 points 1 year ago

Some music video titled "rap god" or something.

[–] [email protected] 7 points 1 year ago* (last edited 1 year ago)

I just had issues logging in, so I'm gonna make a comment in case anyone else is having issues.

TL;DR: Clear your cookies.

I couldn't log in from the main page, I would type everything correctly and it would give me a "logged in" popup in the corner, but I wouldn't actually be logged in. For some reason though I ended up being able to log in from my profile page though, but I wouldn't stay logged in unless I opened up my profile page and navigated from there. I was also able to log in from the main page while in a private window though, (incognito for chrome users) so I figured clearing my cookies would fix the issue. That's what I ended up doing, and I was able to log in from the main page and this time I stayed logged in. Sorry for the ramble, but I just wanted to put down everything that happened since it's clearly a bug with the site, and if someone were to fix this they're gonna want as much details as can be provided.

[–] [email protected] 6 points 1 year ago (1 children)

glad things are back to normal, hope yall harden security. Thanks for your work

[–] [email protected] 8 points 1 year ago* (last edited 1 year ago)

Well, I don't technically work on the lemmy codebase (I have my hands full with adminning 3 instances and working on Hajkey), but yes I agree it'd be nice if the lemmy dev team could spend some time reviewing and improving the security, in amongst all the other stuff they have to do since Reddit imploded.

[–] [email protected] 6 points 1 year ago

@supakaity that's a 500 ... Other source?

[–] [email protected] 5 points 1 year ago

Thanks for everything 💜

[–] [email protected] 5 points 1 year ago (1 children)

Something still seems broken on the home page. Multiple browsers, clearing cookies, private mode, etc have the same error message. Voyager is also unable to log in. Memmy working ok.

Home page and almost every link from the home page look the same.

[–] [email protected] 10 points 1 year ago (1 children)

Sorry about this. It was caused by an erroneous emojo making the site info endpoint fail to load. Issue is fixed now.

[–] [email protected] 5 points 1 year ago

I noticed right away, thanks for the hard work!

[–] [email protected] 5 points 1 year ago

Thanks for handling this super quickly! Y'all are the best! blobcat, huggies

[–] [email protected] 4 points 1 year ago (1 children)

I had to completely reset my password to be able to log in, but I'm unable to log in anywhere except for where I reset my password. I've cleared my cache/cookies, I've cleared all data for any Lemmy apps I have, but it still doesn't work. Any suggestions?

[–] [email protected] 3 points 1 year ago

I'm having the same issue, I can only log in on firefox, nowhere else. I've cleared cookies for my other browsers and cleared the data for jerboa.

[–] [email protected] 3 points 1 year ago

Eep. I'm glad that everything is back to normal sorry you had to deal with it. I was away and didn't get to use Lemmy all weekend so basically I feel like the guy in the Community gif that I always see online :P

[–] [email protected] 2 points 1 year ago (1 children)

Many thanks for sharing and quick measures taken 👍 I tried to change my password now, but it doesn’t safe the new one in my personal settings. Is there anything to consider additionally?

[–] [email protected] 2 points 1 year ago (1 children)

Not sure.

Some people have had to clear cookies to get things working again properly.

Are you getting an error message in the javascript console?

[–] [email protected] 1 points 1 year ago (1 children)

Hi Kaity, thank you for answering so quickly and sorry took a while for me. I am using my iPad and it’s Safari. I noticed that everything seems to be a bit delayed, slow. I have again tried to set a new password and I tried to log out afterwards but the log-out somehow doesn’t work. I suppose there is a time limit to stay logged ans I will wait for that to try again the old and new password (today my Safari safed one worked thankfully)

[–] [email protected] 1 points 1 year ago (1 children)

It seems like it is an identified issue with token invalidation in lemmy and they will be fixing (or have already fixed?) it in a future upgrade.

I'll keep an eye out for it and try to get it in as soon as possible. In the meantime, clearing site cookies while tricky is the only real option.

[–] [email protected] 1 points 1 year ago

Thank you very much 👍🏻

[–] [email protected] 2 points 1 year ago

Interesting, took me a little.. but after 3 login attempts I was able to login

[–] [email protected] 1 points 1 year ago (1 children)

I haven't logged on to instances for a week and everything is already on fire.

Looks like I missed all the fun.

[–] [email protected] 1 points 1 year ago

i don't use the main blahaj lemmy site so i probably would've not seen it anyway

load more comments