Kiwi Farms says it has been hacked and user details leaked

Controversial online forum Kiwi Farms has reportedly been hacked, leaking user details of some accounts.

Since its founding in 2013, the site, which describes itself as “a community dedicated to discussing eccentrics who volunteer to deceive themselves,” has an extremely chaotic history, linked to at least three suicides and the 2019 Christchurch mosque shooting. about in New Zealand.

Kiwi Farms has been struggling to find support from the tech industry, with cloud hosting infrastructure companies Cloudflare and DDoS-Guard recently opting to stop serving the site, causing it to be inundated with DDOS attacks.

What exactly happened?

The site’s de facto leader, Joshua Moon, once statement (opens in new tab) Using the .OPUS lossy audio encoding format, “bad actors are able to upload web pages masquerading as audio files” to XenForo.

ZenForo is a commercial internet forum package for building forums like Kiwi Farms

According to Moon, the attackers were then “able to load this web page (possibly as an iframe), causing a random user to make an automatic request and send their authentication cookie off-site so that the attacker could use it to access their account”.

Moon adds; “Once they have access to ACP, they try to download user data, and XenForo provides a way to export a list of users with precise information: email, username, last activity, registration date, user Status (banned/unverified), number of posts, if they are employees.”

However, according to the administrator, the hacker’s request “doesn’t appear to go through because they requested too many records at once”.

Moon admitted that his own administrator account was “compromised through this mechanism.”

Kiwi Farms issued a statement on the matter saying that all users should assume their passwords have been stolen

Additionally, users should assume that their email address has been compromised, and they should also assume that any IP they used on their Kiwi Farms account in the last month has been compromised.