Kiwifarms under attack | Veteran of the Psychic Wars | The Internet is for EVERYONE.

[Hadrian Hardrada Cicero]

pretty bad

Kiwi Farms

Announcements and coordination during downtime. Archive & RSS: https://tg.josh.rs https://kiwifarmsaaf4t2h7gc3dfc5ojhmqruw2nit3uejrpiagrxeuxiyxcyd.onion/

t.me

"Yesterday, Vsys, a host we used as a forward-proxy, was compromised.

Today, the site was hacked to change everyone's avatars to logos of another site (which I am not naming because I'm not sure what the motivation is behind it).

Then, each node on the forum index was deleted one at a time.

There are backups of the site so no information is permanently lost but I have not diagnosed what the attack vector was yet or the extent of the breach."

A Follow up

 

[IlluminatiPirate]

A Follow up

View attachment 37195

Shit this scares me because we use xenforo, ill ask xenforo if they have a way to combat this for us

 

[Hadrian Hardrada Cicero]

@IlluminatiPirate

 

[Collision]

A Follow up

I'm really disappointed no one has emailed me yet.

 

[ZinRicky]

@IlluminatiPirate

View attachment 37206

Does this mean that this forum could be attacked as well?

 

[Hadrian Hardrada Cicero]

Does this mean that this forum could be attacked as well?

We're a little smaller than the farms, there only 3,700 of us here. I doubt we'll be next.

 

[W1NTER]

A Follow up

View attachment 37195

So did the entirety of Kiwifarms and their associated user data get compromised?

 

[Collision]

So did the entirety of Kiwifarms and their associated user data get compromised?

You should assume as much.

 

[h00]

Shit this scares me because we use xenforo, ill ask xenforo if they have a way to combat this for us

delete yer logs

 

[Shantotto]

Anybody know what the pfps were changed to?

 

[IlluminatiPirate]

Anybody know what the pfps were changed to?

People are saying it was poa.st

 

[punishedgnome]

Shit this scares me because we use xenforo, ill ask xenforo if they have a way to combat this for us

It sounds like it was some custom add-on Josh had made himself. He also hasn't been getting updates from Xenfor for some time as they banned him.

I also can't imagine this site is high-profile enough to be an enticing target.

This is why I make a new Protonmail account for every forum.

 

[mydadiscar]

Shit this scares me because we use xenforo, ill ask xenforo if they have a way to combat this for us

Gee, you want to spell it out for people?
Hay guise! Here's how someone hacked a forum! We use the same forum software as them! I better find out how to fix this!!!

 

[Hadrian Hardrada Cicero]

.net is back on with statements

 

[Andy Kaufman]

Gee, you want to spell it out for people?
Hay guise! Here's how someone hacked a forum! We use the same forum software as them! I better find out how to fix this!!!

Anyone even remotely familiar with this stuff can see that agora road uses xenforo.
I saw it on the front page already before I even had an account. It's not like that's some hidden detail pirate just released.

 

[Hadrian Hardrada Cicero]

We're going radio silent. Keep on trucking people.

 

[mydadiscar]

View attachment 37238

We're going radio silent. Keep on trucking people.

...anime avatar martial law?

 

[Collision]

More than anything else about this fiasco, what bothers me is that Null positions himself as a trustworthy expert for his users to listen to.

 

[handoferis]

.net is back on with statements

View attachment 37227
View attachment 37228
View attachment 37229

Fuck me this is bad. Hooking up a chat you made to the database/session state for an out of date forum is fucking dumb and raises your attack surface considerably (i.e. you now have forum*chat vulns, as opposed to forum+chat vulns), and is exactly how sessions and shit get stolen. Null calls it an XSS vulnerability but he basically opened the hole, all they had to do was poke through. This is the kind of shit you might be able to get away with (still bad idea) if you didn't have a target painted on your back, but KF does and has for a long while now.

 

[punishedgnome]

More than anything else about this fiasco, what bothers me is that Null positions himself as a trustworthy expert for his users to listen to.

Yes, it certainly seems like this exploit was his fuckup. He gloated quite a bit when Ethan Ralph's shit got hacked, and that looks really bad now in hindsight.