Last night the instance lemmy.world suffered a JavaScript injection attack. The attack set out to steal login cookies of users upon visiting infected threads, primarily targeting admins.
Potentially Affected Data
- E-Mail address stolen and/or changed (if provided in user settings)
- Password changed
Mitigations
Malicious comments have been replaced by a removal message. I have deployed the UI hotfix and @ludrol@bookwormstory.social has deleted all Custom Emoji until it is clear whether those are safe to use. Additionally all login sessions have been invalidated as a safety precaution as well, any cookies that were stolen are now rendered useless.
Conclusion
So far it does not seem like this instance was affected.
If you are not using bookwormstory.social and your instance is not on UI Version 0.18.2-rc.1 please be aware that you are likely still at risk of the attack, please check for any announcements of your instance administrators.
Jeez, I just upgraded last night. Guess I’ll be upgrading again!
Such is the life of server admins I guess 😅
At least it’s straightforward to do. At some point I may even automate the process like I have on my other instances.
lemmy.fmhy.ml web ui went down this morning (and is currently down).
Acess via lemmy api using 3rd party apps isn’t affected.
Do you think upon ui update lemmy passwsord should be changed? (I use a unique random generated pasword for lemmy).
There is no way for the attackers to have gained access to the passwords so no, a new password won’t be neccessary.
Edit: if you feel safer that way, you can of course generate a new password but given the password handling as I understand it nothing short of a totally compromised server machine or a keylogger on your end should get your passwords exposed
