Hey folks! I have spent this morning helping lemmy.world mitigate the issue. I have also sent out mitigation instructions to other admins as well.
For the particular exploit that was used on lemmy.world:
- It does not spread through federation
- lemm.ee was not vulnerable in the first place
- As mentioned above, it has already been mitigated on lemmy.world
So there should not be any reason to defederate. I will continue monitoring and investigating, if further vulnerabilities pop up then I will adjust accordingly.
You rock! Sorry if this is a stupid question, but if both instances are running the same version of Lemmy, why would lemmy.world be affected but not lemm.ee?
Malicious custom emoji contained scripts that sent session cookies to the attackers.
It should be said that the version number is more of an indication than anything specific. I don’t think it would be hard for an instance to spoof its version number.
Also, lemm.ee in particular has a few mods and tricks that might not be in the lemmy codebase yet - @sunaurus@lemm.ee has previously included new code he has pushed to the main stack before it has been accepted. This allowed us to have working versions of things before other instances.
Point being, two instances with the same version can have different code and implementations.
Thinking about things in the future, if something were to happen to lemm.ee, how could users stay up to date with you and the other admins? do you have a mastodon account to follow or maybe matrix? for things like maintenance, emergencies, etc.
I don’t know enough to agree/disagree, but upvoted for raising the point, and to give it attention.
this instance is really reliable. there is no shaking it! really glad to be here.
How would a compromised instance affect us? The worst they can do is send spam posts.
Both instance are down at the moment.
Indeed though it’s still a bit up in the air who exactly has control of the instances, so they may come back online still compromised.
Looks to be that admin accounts were compromized by hijacking admin sessions, so the infrastructure is safe.