Promo Code from: https://youtu.be/PUeZQ3pky-w?t=265

Why YSK: It appears several Lemmy Instances are flagged as suspicious and at least 1 instance intentionally using the name of ransomware. A couple of the big enterprise monitoring suites (Fortiguard, ZScaler) will flag your account and may end up with you being pulled into an office for an explanation, or worse.

TL;DR: Keep browsing to your local instance at work for now.

cross-posted from: https://lemmy.world/post/1860512

As we see more and more bots on Lemmy World every day, it’s about time we publish a set of rules for bots and bot-owners.

So here goes:

• Bots shall not be used for any kind of advertising.

• The bot accounts must be clearly marked as a bot.

• The owner of the bot and contact details must be mentioned in the bot’s bio.

• Bots are only allowed to post in communities they have the explicit permission from the community’s owners to do so.

• Bots from other instances that post in Lemmy World communities must follow the same rules.

• Bots shall not just be posting Reddit content.

• Bots shall not be “spammy”, as in multiple posts per minute.

• Breaking any of these rules will result in a ban for the Bot and, if required, its owner.

• Commands must use the bots mention as prefix, and not a text prefix like !help

These rules will be updated when needed.

Hi all,

If you're just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

How?

This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.

Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.

What happens next?

As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you'll likely see:

1. Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:

• Exactly what happened, when.
• The incident response that occurred from instance admins
• Information that might have helped resolve the issue sooner
• Any issues that prevented successful resolution
• What should have been done differently by admins
• What should be improved by developers
• What can be used to identify the next attack
• What tools are needed to identify that information

2. A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.

3. A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I'll look into crowdfunding this cost.

What I know so far:

• vlemmy is still "up" and intermittently accessible. It is running slow as hell, PLEASE DO NOT VISIT THE INSTANCE as it will likely only slow things down more and make it inaccessible again.

• Stripe, Librepay, and Github accounts are all closed. Closure date unknown
• Reddit account still exists and has been messaged
• No mentions of the instance in Element.io chats but still searching
• They have almost certainly NOT lost their domain. Who.is historical records show no ownership or nameserver changes.

I have some minor personal details I've found that I'll be deep driving on later, but it's 1AM EST. I'm heading to bed but will continue on the investigation around 9AM EST.

Update 1PM EST July 9th:

Hi all, I'm working through about 40 different potential leads right now.

Although I need some help! Specifically, I need people who have viewed !kerbalspaceprogram@vlemmy.net to check their browser cache for this image:

https://vlemmy.net/pictrs/image/928b2f95-a37c-4e94-bd70-bc014c8655d4.jpeg

You can do so using one of the following NIrsoft tools:

• Chrome: https://www.nirsoft.net/utils/chrome_cache_view.html
• Safari: https://www.nirsoft.net/utils/safari_cache_view.html
• Opera: https://www.nirsoft.net/utils/opera_cache_view.html
• IE / Firefox / Misc: https://www.nirsoft.net/utils/image_cache_viewer.html

I'm hoping since it's a historic image linked to their internet presence that it might generate specific leads.

I'll update more as things progress.

Dear god, this experience with them has been horrible.

I lent some money to a friend via it because they use it. I just wanted them to pay me back via PayPal. The friend forgot and sent the repayment via CashApp so I returned it as CashApp can't Cashout to any of the institutions I bank with. Instead of using my CashApp balance, it decided to charge my debit card for that transaction. No problem, I thought, this is something I've had happen elsewhere and is easily fixed with a phone call.

Checking in the app, they only have Chat listed. I tried the chat and it's either a damn Chat Bot, or their employees are stuck using stock replies and can't reply anything custom. I eventually found their phone number in their Terms of Service which the only option was a callback which took over 2 hours. Once I did get the callback it was very obviously someone overseas who did not understand the situation and was of no help. I ended up hanging up on them.

In the end, I've ended up sending them a "Pre-Filing Requirement to Attempt to Resolve Disputes" as required in their Terms of Service. Thankfully, I do shipping as part of my employment so this costed me nothing to ship a letter overnight with signature required. However, I'm sure I'll have to deal with a lot of bureaucracy now from their legal department's arbitration division.

Not once in my nearly 20 years of banking have I dealt with such a shitty financial company. With my credit union, while they can be a bit slow they've never given me issues trying to fix something. With PayPal, I've never had an overseas rep during a phone call and was able to get someone on the line during the same call (within business hours). Heck, even PNC was clunky to use, but it at least worked. CashApp obviously is doing the bare minimum and I hope they go out of business.

Is anyone here NOT from Louisville or Lexington Metro Areas?