While I was asleep, apparently the site was hacked. Luckily, (big) part of the lemmy.world team is in US, and some early birds in EU also helped mitigate this.
As I am told, this was the issue:
- There is an vulnerability which was exploited
- Several people had their JWT cookies leaked, including at least one admin
- Attackers started changing site settings and posting fake announcements etc
Our mitigations:
- We removed the vulnerability
- Deleted all comments and private messages that contained the exploit
- Rotated JWT secret which invalidated all existing cookies
The vulnerability will be fixed by the Lemmy devs.
Details of the vulnerability are here
Many thanks for all that helped, and sorry for any inconvenience caused!
Update While we believe the admins accounts were what they were after, it could be that other users accounts were compromised. Your cookie could have been ‘stolen’ and the hacker could have had access to your account, creating posts and comments under your name, and accessing/changing your settings (which shows your e-mail).
For this, you would have had to be using lemmy.world at that time, and load a page that had the vulnerability in it.
May I ask was is the JWS coockinand if it is automatically changed or if we have to change it in a way?
Basically it is what is generated when you log in. Think of it as being related to your user name and password but not I’m a way that exposes it. Rotating the secret causes all of these JWT tokens to no longer be valid.
Think of it a bit like this: you are a spy and were told a code word to authenticate your identity. While you were away, that code word is changed, so you no longer have an easy way to validate your identity. You must now start again from scratch.
I’m not sure what to make of the coockin’and thing but no, the JWS secret was changed server-side. You don’t have to do anything!