June 11 Moderation Panel Breach

On June 11th, a group of people hacked into a moderator's account and used their access to vandalize the website, delete videos, and look at account email addresses. The vandalism lasted for about 6 hours before I was notified and shut the site down to investigate.

VidLii itself did not suffer any exploits or database leaks, and no passwords were compromised. Unfortunately, this did show us that our security requirements for moderators were lacking.

We take daily backups, so the impact of this incident was minimal, only losing one day of videos and activity.

What Happened

Shortly before the moderator's VidLii account was compromised, an individual who had previously been banned on VidLii used password stuffing to hack into the moderator's personal Google accounts, then used that access to break into one of his Discord accounts.
The moderator had very poor security practices: using weak passwords, reusing passwords, and storing passwords in Discord DMs and private servers.
Once the hacker got access to his Google and Discord accounts, he used that as a springboard to break into more accounts, and ultimately to get hold of the moderator's VidLii account and the second factor password required to log into the website's moderation panel.

During the process of breaking into the moderator's accounts, they deleted irreplaceable files on his accounts and accessed unrelated accounts just to cause him grief.

Once the hacker found the credentials necessary to log into the moderator's VidLii account, he gave access to some of his friends, many of whom were also users who had been previously banned.
They used this access to set a header banner on the site with custom HTML and CSS to prank users. One of the more destructive things they did was delete tens of thousands of videos. We have backups, so this just meant it took longer to restore the site.

Around 08:50 UTC, June 11th, I was notified about the vandalism and quickly shut the site down to investigate. I began rolling back the site to the snapshot taken the previous day.

What We're Doing

This could arguably have been avoided if we enforced stronger security requirements for moderators. To rectify this, we've added an option for accounts to use TOTP 2FA, and made this mandatory for moderators.
We've also removed all inactive moderators, and we will be looking for new ones to replace them.

Addendum

All things considered, this could have been a lot worse. We lost one day of videos, were offline for a day, and had to rework moderator security, but I guess that's tolerable.

We're sorry this whole incident happened. It's pretty embarrassing, but we're making an effort to reduce the likelihood of future events like it.

Thanks for reading.

- ☣️ BF3k