Original Post:

https://lemmy.dbzer0.com/post/536477

Title:

PSA: Lemmy.world has been compromised!

Post:

FYI!!! In case you start getting re-directed to porn sites.

Maybe the admin got hacked?

Images:

First, some random video show up, I’m not gonna watch it in case its NSFL content.

Second, the website tries to redirect me, but uBlock Origin blocked it

The Front Page

Side Bar got messed up.

Everything else seems fine, here is the signup page with the Lemmy Version visible.

Also notable comment from the Original Post:

Yea, I switched to this alt. It appears to be one of the assistant admins accts. Seems like an old fashioned anon prank, to me, they’re mainly just trying to make stuff offensive and redirect people to lemonparty.

So, y’know, old school.

I don’t know if any data is actually in danger, but I doubt it. I don’t see why assistant admins would need access to it.

Edit: Someone else said an admin’s credentials was compromised:

One of the admin accounts appears to have been compromised. The owner/other admins appear to be aware now because that account had its admin access revoked and offending posts are being removed.

Definitely opens up a big question about the security of Lemmy instances that I am sure will be discussed over the next few days.

@db0@lemmy.dbzer0.com be careful with making admins. And secure your passwords, use 2fa, etc…

Edit 2: Now the entire front page is filled with posts regarding the lemmy.world hack. Interesting…

https://i.imgur.com/VvxiphP.jpg

Edit 3: Lol a post was made from the hacked account claiming the hack was fixed, but that account is still under the hacker’s control:

https://archive.is/hRytN

  • Machinist3359@kbin.social
    8·
    1 year ago

    One of many nice aspects of the fediverse, it’s not a software monoculture that can be wiped out by a single exploit.

    • YMS@kbin.social
      3·
      1 year ago

      But on the downside, as long as it is a vulnerability that’s not instance-specific or could be federated, you’ll have to investigate not one network / database / server cluster / software stack / user group / etc., but possibly hundreds or thousands, operated by mostly amateurs with very different levels of knowledge, living in very different time zones, having different availability.