Yea I've got both .zip and .mov blocked on my pihole
tarjeezy
joined 2 years ago
Good luck, I'm behind 7 proxies
Good luck, and thanks for all your hard work. I don't know if you already saw this, but it looks like this might be the vector for the account compromise. If that's the case, I don't think 2FA is enough to protect, because it's exfiltrating the session cookies of someone already logged in. Seems like the precaution is for admins to avoid clicking any suspicious links. I realize the irony of sharing a link about this, but at least it's to a thread on this instance.
The encoded string contains the URL zelensky dot zip. Zip is one of the newer top-level domains. It itself is not a zip file, but I am not going to visit that site to find out whatever treasures it has to offer..
Thanks for digging in and sharing your findings!
Last I saw, they were on 0.18.1, unless a very recent update was installed. Do you happen to have a full list of domains they were redirecting to? Just want to be sure they were only going to "harmless" offensive sites, and not something worse.
Really hoping it's "only" redirecting to offensive sites, and not to malware. I got redirected a few times, before I closed my browser.
If any other device on your network, such as your phone, exclusively uses pihole for DNS, they won't be able to resolve web addresses when your computer is off - effectively cutting off internet access. Pihole should really be running 24/7 to avoid complications.
It doesn't seem like you actually need the https:// to parse the instance name, since the text xxxxxxxxlemmy.worldx still searches successfully. Maybe just exclude those parts off the URL and simply use lemmy.world, lemmy.ml, etc in the autocomplete list.
Hello, I commented about a bug in the instance selector on a cross post, not realizing that wasn't the actual developer. Not sure if it's related to what you're talking about here, but I wanted to bring it to your attention. Great project by the way!
By the way, neat project! It looks like it's filling a pretty big need that people having been asking for. Keep up the good work!
So, simply viewing a comment thread with a maliciously-altered emoji (on an unpatched instance) was enough to compromise your account?