About the downtime and security incident
21 points by ettolrach
21 points by ettolrach
This is fascinating. Must be tough getting owned by Flash of all things in 2026.
Another interesting thing is that usually a discovered bug gets the attacker a way in. In this case attacker actually fixed a bug to enable the attack.
I'm curious how it worked on a technical level, did it use something like Ruffle to make same-site fetch requests?
Sounds like it:
We didn't sandbox the Ruffle player used for playing Flash videos. We didn't do this because we didn't recognize the need for it at the time, since new Flash uploads had already been disabled.
I don't understand how getting your username and IP would allow someone to 'create a backdoor API key', which wasn't used anyway, and still allowed them to upload files as you. Am I lacking the imagination or knowledge to understand how that was possible? I would think username + IP does not give anyone access to anything...?
Can someone explain? I guess my assumption is that there's an unspoken 'it also stole your auth cookie in addition to username and IP'?
Yeah, this is only mentioned in passing, but the exploit was a XSS. This allowed it to use JavaScript to execute any actions on the website that your browser would have access to. Opening the external resource so that they can log your IP was one of those actions, it isn't what granted the access.
Just warning that the main website is NSFW.
Interesting attack pattern but you might not want to click on the main page.