https://archive.ph/rvdzk
> Yesterday, vsys - one of our hosts out of Ukraine - was compromised. I initially believed that this allowed a hacker to take over that webserver and snoop data as a man-in-the-middle. I no longer believe that is the case.
> A bad actor was able to upload a webpage disguised as an audio file to XenForo. Elsewhere, he was able to load this webpage (probably as an inline frame), causing random users to make automated requests and send their authentication cookies off-site, so that the attacker could use it to gain access to their account. My admin account was compromised through this mechanism.
> Once they had access to the ACP, they attempted to download user data, and XenForo provides a way to export user lists with information that is precisely: email, username, last acitivity, register date, user state (derezzed/unverified), post count, and if they are staff.
> However, their request did not appear to go through because they requested too many records at once. The following record reports a 500 error and no content.
Jersh claims he has a backup from September 17 he will restore soon, but he needs to completely wipe and rebuild the server first.
Live updates from the Telegram channel: https://t.me/s/kiwifarms
Watch Hacker News users soykaf themselves in this thread: https://news.ycombinator.com/item?id=32889437
> Assume any IP you've used on your Kiwi Farms account in the last month has been leaked.
I assume this won't be as much of a problem as last time KF got hacked because of the massive increase of users using the Tor hidden service instead of the constantly-rotating clearnet domains.
What ramifications do you think this hack will have for the wider Internet? What could KF users have done differently to save themselves?