While I was asleep, apparently the site was hacked. Luckily, (big) part of the
lemmy.world team is in US, and some early birds in EU also helped mitigate this.
As I am told, this was the issue: - There is an vulnerability which was
exploited - Several people had their JWT cookies leaked, including at least one
admin - Attackers started changing site settings and posting fake announcements
etc Our mitigations: - We removed the vulnerability - Deleted all comments and
private messages that contained the exploit - Rotated JWT secret which
invalidated all existing cookies The vulnerability will be fixed by the Lemmy
devs. Details of the vulnerability are here [https://lemmy.world/post/1293336]
Many thanks for all that helped, and sorry for any inconvenience caused! Update
While we believe the admins accounts were what they were after, it could be that
other users accounts were compromised. Your cookie could have been ‘stolen’ and
the hacker could have had access to your account, creating posts and comments
under your name, and accessing/changing your settings (which shows your e-mail).
For this, you would have had to be using lemmy.world at that time, and load a
page that had the vulnerability in it.
Confesso que não percebo do tema, mas será algo que nos poderá atingir no lemmy.pt?
Atacados penso que não, mas a brecha poderia estar lá sem ninguém ter tomado proveito da dela. Mas já existe um fix para o problema além de que dava pra apagar esses custom emojis pra não ter a brecha
Quer isto dizer que não fomos afectados? Segundo o que li algures, outras instâncias foram afectadas. Devem ter atacados as maiores, não?
Atacados penso que não, mas a brecha poderia estar lá sem ninguém ter tomado proveito da dela. Mas já existe um fix para o problema além de que dava pra apagar esses custom emojis pra não ter a brecha