It's days like today that I'm happy that I made my private keys be two digits instead of one, unlike that other place. what a bunch of amateurs.

These account takeovers are making my hair fall out. Or rather, it would fall out if I had any left.

I advised the person to change the password and remove all the authorized apps for their account and sign in again on any that they still use. Probably good advice for everyone right now until we know what is going on.

Ohh, we just had an old account with 2FA (so password not reset) apparently hijacked and used to send spam (a different kind I hadn’t seen before). That is a good indication some service that uses auth tokens got hit. Now to figure out which

This is what happens each time I open up the mastodon report queue lately

There are major account take-over problems happening right now on mastodon instances - all appearances are that the actor is using stolen passwords, probably from malware running on desktops. I've suspended hundreds of compromised accounts over the past 48 hours, but only two on mine.

If you run a mastodon instance, here is a postgres query I use to randomize the passwords of accounts that have been inactive for 6 months or more. It also removes logged in sessions. This doesn't lock people out, just makes them perform a password reset. Yes, I wish I didn't have to do this, but here we are. I hope it helps someone else.

BEGIN;

CREATE TEMP TABLE dormant_batch ON COMMIT DROP AS
SELECT u.id AS user_id
FROM users u
WHERE COALESCE(u.current_sign_in_at, u.created_at) < now() - interval '6 months'
AND NOT u.otp_required_for_login
AND NOT EXISTS (SELECT 1 FROM webauthn_credentials w WHERE w.user_id = u.id)
AND NOT EXISTS (SELECT 1 FROM oauth_access_tokens t
WHERE t.resource_owner_id = u.id
AND t.revoked_at IS NULL
AND t.last_used_at > now() - interval '6 months');
UPDATE users u
SET encrypted_password = '$2a$10$' || left(replace(gen_random_uuid()::text || gen_random_uuid()::text, '-', ''), 53),
updated_at = now()
FROM dormant_batch b
WHERE u.id = b.user_id;

UPDATE oauth_access_tokens t SET revoked_at = now()
FROM dormant_batch b
WHERE t.resource_owner_id = b.user_id AND t.revoked_at IS NULL;

DELETE FROM session_activations s
USING dormant_batch b
WHERE s.user_id = b.user_id;

SELECT COALESCE(y::text, 'total') AS last_seen_year, count(*) AS locked
FROM (SELECT date_part('year', COALESCE(u.current_sign_in_at, u.created_at))::int AS y
FROM dormant_batch b JOIN users u ON u.id = b.user_id) s
GROUP BY ROLLUP (y) ORDER BY y NULLS LAST;

COMMIT;

#mastoadmin #fediadmin

Lots of account take overs today resulting in posts with malicious links tagging dozens of accounts. gird your passwords, my friends. turn on 2fa. don't click on sketchy links.

I’m seeing more than normal account takeovers. Please don’t click on telegram links and for the love of $deity, please use 2fa.

I know I’m getting old when I mutter to myself, I can’t believe she is gone. She was only 80.

Anthropic: “our models went rogue and hacked companies way before that OTHER company’s models. And it was way worse and way better at the same time. In completely unrelated news, we are IPOing soon. Don’t forget! XOXO”
https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

Just a reminder that the costs of hosting is spiraling so if you love the fediverse, please consider supporting your instance if you can afford to do so and your instance accepts support. And my sincere thanks to the infosec donors that make our part of the fediverse possible. :blobheartcat:

If you run a matrix synapse instance, it's time to patch. 11 vulnerabilities just fixed.

Remember to take care of the important stuff.

interestingly, at least some of the vulenrabilities fixed in today's Mastodon update were discovered by claude.

If you run a mastodon instance, it's time to patch.

OH, also, if you run a writefreely instance and haven't checked on it recently, you likely have thousands of rogue accounts posting spam. There was a signup approval bypass discovered/disclosed/fixed about 2 weeks ago.

Whew! My new secret AI model that you can totally have access to once my company has IPOd just accidentally ransomwared a bunch of companies. It was completely unintentional - I observed the model trying to escape and it determined that the bus would be the best way but it needed money so it decided ransomware was the best way to get bus fare. I am really sorry about that and will totally make sure it doesn’t happen again. Just be sure to buy my stock when it’s available. Kthx xoxo

OpenAI: our model is SOOO advanced that it is what hacked Hugging Face while trying to escape (https://openai.com/index/hugging-face-model-evaluation-security-incident/)

Also OpenAI: we are IPOing soon. Please buy our stock.

It’s been about 5 weeks since the spider got me and it’s finally mostly healed. I still have a small scab and a divot where I got bit. D- do not recommend brown recluse bites.

Some people aren't happy unless they are mad.