Kiwi Farms has been breached; assume passwords and emails have been leaked
Quote:
The head of Kiwi Farms, the Internet forum best known for organizing harassment campaigns against trans and non-binary people, said the site experienced a breach that allowed hackers to access his administrator account and possibly the accounts of all other users.
On the site, creator Joshua Moon wrote:
The forum was hacked. You should assume the following.
Assume your password for the Kiwi Farms has been stolen.
Assume your email has been leaked.
Assume any IP you've used on your Kiwi Farms account in the last month has been leaked.
Moon said that the unknown individual or individuals behind the hack gained access to his admin account by using a technique known as session hijacking, in which an attacker obtains the authentication cookies a site sets after an account holder enters valid credentials and successfully completes any two-factor authentication requirements. The session hijacking was made possible after uploading malicious content to XenForo, a site Kiwi Farms uses to power its user forums.
“A bad actor was able to upload a webpage disguised as an audio file to XenForo,” Moon wrote. “Elsewhere, he was able to load this webpage (probably as an inline frame), causing random users to make automated requests and send their authentication cookies off-site, so that the attacker could use it to gain access to their account. My admin account was compromised through this mechanism.”
https://arstechnica.com/information-tec ... en-leaked/I don't know why but I keep getting Alanis Morissette stuck in my head.
_________________
"If you stick a knife in my back 9 inches and pull it out 6 inches, there's no progress. If you pull it all the way out, that's not progress. The progress is healing the wound that the blow made... and they won't even admit the knife is there." Malcolm X
戦争ではなく戦争と戦う