Kiwi Farms has been breached; assume passwords and emails have been leaked
arstechnica.com
arstechnica.com
With the only smoking gun, as far as anyone can tell (but you can't look anymore because the pressure campaign got it removed from the Internet Archive), being two posts in a thread of 50,000 posts that were made from sleeper accounts that were deleted immediately.
And only a few people cared to look into it rather than echo exactly what the pressure campaign claimed to be true.
That should be very concerning.
I definitely recommend the linked podcast. I found it surprisingly fair to the parties involved.
> Cloudflare not only provided DDoS protection, they also accounted for many popular exploits like this. As I've worked for weeks to combat the endless flow of attacks from every conceivable angle I have spread myself very thin and hurridly[sic] replaced old systems with new ones that are not properly vetted.
This is the counterpoint to the argument people should self-host and not use the Cloud. It turns out the Internet never got less server-hostile at the infrastructure layer, and weaknesses in various commonly-used systems are still there. When you're on the Cloud, the tradeoff is that you're a guest in someone's house, but the cleanliness of the house is someone else's problem.
Where does it end?
Find it quite weird how there was no database dump yet, can't see a reason to hold on to it, it would be pretty funny to get access then getting blocked by php being php. Owner claims there was not much to leak due to good opsec from users after the 2019 leak so we'll see.
Anyone with a large phpbb/vbulletin/xenforo install can tell you that the built-in GUI tools fail with even modest userbases. They just run mysql queries in a php request and hit the php.ini timeout, so you have to use CLI tools.
If all the attacker had access to was the forum front-end (rather than the machine) and they weren't particularly prepared, it wouldn't be surprising if they didn't achieve anything.
That people wanted accounts with emails and persistent identity on a forum dedicated to harassment is also bizarre.
What's the purpose of being a master troll if you can't get meaningless internet points for it?
Just because we made unsavory posts doesn't mean we wouldn't want to register a pseudonym.