2 Instances are being used for coordinated vote manipulation, and should be defederated. chinese.lol lemmy.doesnotexist.club

The attacker seems to be the admin of those two instances. Both instances have their registrations closed.

Edit: It is now open for both of them, or was already. I checked the Fediseer page for both instances and it still says that their registrations are closed.

Though it is suspicious that no captcha, email confirmation or manual approval is required for both of these instances. The admin of lemmy.doesnotexist.club seems to be inactive since their account creation yet this instance is still running. If the admin is the attacker, it could also be that they are the one behind the recent nicole spam.

https://gui.fediseer.com/instances/detail/chinese.lol

https://gui.fediseer.com/instances/detail/lemmy.doesnotexist.club

cross-posted from: https://hackertalks.com/post/8713785

The instances being used are
lemmy.doesnotexist.club
chinese.lol
Here is an example of the coordinated downvoting https://hackertalks.com/post/8692093
Of course its a controversial user who got someone angry enough to automated downvoting @[email protected]
But you can see every post they make gets 53ish downvotes from these two instances, plus some organic ones after a few hours.
Current downvoting Accounts :::spoiler bot-list
[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] :::
A individual user airing their personal biases and manipulating lemmy isn't good for the community, regardless of how you feel about their target. This is a really bad thing (tm)

64 comments

Can your detection method be automated and federated?
I'm asking because this is probably the thin end of the wedge and is likely to increase exponentially, especially since anyone can set up an instance and do whatever they like with it.
- Wdym. Do you mean how I found out that the attacker was the admin? Yeah sure, you definitely can automate that.

I know one of these instances.

Fuck you, Nicole!
- What? She lied to us? 😱
  
  The Liar Who Spammed Me
  
  What? Your favorite spammer betrayed you? I'm soooo sowwy :3
  
  How could it be!? I could have sworn Discord was end to end encrypted, federated and open source!
  /s
  
  How could it be!? I could have sworn Discord was end to end encrypted, federated and open source!
  /s
- Don't you besmirch my fediwife's good name!
  
  Where are your God now?
- Stumblechat Room: HELL
- What app are you using?
  
  Sync, at least to Lemmy 1.0. Then, probably Raccoon.
- Make sure to click all of those links

Seems relatively painless to chop those two instances off - chinese.lol has less than 200 users, and I can't even find instance info for doesnotexist.club (coincidence? i think NOT).
I do personally wonder how difficult it is to spin up new instances though. How much effort would it be for them to create a new one and do it again?
I'm actually most concerned with the IP leaking of the fediverse chick posts - hopefully some progress has been made with the IP leaking in auto-loaded external media through DM's
- Some instances enable the image proxy, which should prevent this.
- How much effort would it be for them to create a new one and do it again?
  Minimal, but it is the domain that gets blocked so the attacker would still need to purchase a new domain.
  
  Not with sub domains.
- I checked the images and so far every image I've encountered linked to the users's lemmy instance's pictrs instance, none were hosted through a custom trackable image host.
- I’m actually most concerned with the IP leaking
  I'm curious, what is it about IP leaking that concerns you? I've been thinking about it lately but I have a hard time seeing why it's a problem.
  
  For one, you now know there is someone on the other end, so you can target your attacks instead of trying random ips.
- fairly low effort but annoying like one click with yunohost
- That's what I'm afraid of. Once some bad actors realize Lemmy is as defenseless as it is, it'll be carnage for a while. The only tool we have is defederation and it's slow and borderline useless against spam or worse.

Warned about this 11 days ago. https://lemmy.world/post/27449126
This is still a weakness of the current federation model imo

The attacker seems to be the admin of those two instances. Both instances have their registrations closed.
The alternative theory would be that these instances had open registrations, but rightly closed registration down after the admins noticed the bots. chinese.lol is on 0.18.4 with an admin with a 2 year old account, lemmy.doesnotexist.club has an admin with a 1 year account, and it was also that instance that the 'nicole' person has used before. This downvote attack would need to be a long time in the planning for what you're suggesting to be true.
- Upon inspecting the actual websites, the registrations seem to be actually open for both instances with no email confirmation, captcha or manual approval as one user pointed out. I checked the Fediseer page for these instances. What is the update delay for Fediseer?
  
  What is the update delay for Fediseer?
  I don't know. It's not something I'm familiar with - it might just default to saying 'closed' if it doesn't have the data.
  It's interesting that the obvious bot accounts on those instances were set up in mid-March last year, so I'm guessing that these are somebody's army that they've used before, but overplayed their hand when they turned it on the DonaldJMusk person. The admins can reasonably be blamed for setting up instances with open registrations and no protections and then forgetting about them, but I'd be wary of blaming them for being behind the attack directly. The 'nicole' person is unlikely to have used their own instance - it's probably just someone with the same MO as whoever owns the bots, finding and exploiting vulnerable instances.
  
  Should be 12 hours, unless they explicitly prevent us from accessing their nodeinfo. Which now that I think about it, I should probably notify on.

We need public voting or this will only get worse. It's currently way too easy to manipulate everyone's feed.
- What do you mean public voting? Everything in the Fediverse is public. Spin up a server and you can see all votes, even in the UI as an admin. Do you mean for users?
  
  Admin only isn't public tbh.

Beats me what anybody would get out of vote manipulation on lemmy - there are no sponsors, no money involved AFAIK. What's the payoff, upvotes?
- Pettiness. I guess some people suffer from such extreme grass deficiency that they'll go through all the trouble of setting up bots to do fully automated luxury harassment instead of small-batch hand-raised harassment.
- The person being downvoted is the mod of c/conservative. I'm guessing this is a political maneuver to bury his posts/bully him off lemmy
  
  We don't need bots to do that!
  
  Which one, because all of them have been rightfully conquered for the proletariat other than whatever Universal Monk is getting up to
- Winning the hearts and minds in a propaganda / information war at relatively low cost

Edit: It is now open for both of them, or was already. I checked the Fediseer page for both instances and it still says that their registrations are closed.
Fediseer doesn't check constantly btw.

@[email protected] @[email protected]

Being able to disable downvoting is one of the best features Lemmy has and I wish more instances would do it.
Voting here doesn't influence your feed and downvoting largely serves to spread negativity. Turning it off has a negligible impact on usability and an undeniable advantage when people decide their feelings matter more than someone else's, like whatever this is.
We've de-federated from both the instances being used for manipulative voting.
- Voting here doesn't influence your feed
  It does when you use sorting algorithms that depend on it.
  
  Not with downvotes disabled 😉
- I disagree. Downvoting is essential for Lemmy. I often disagree with something and it's right to have a democratic vote on topics.
  
  Also helps identify trolls and bad actors at a glance if you don't already have them tagged as such.
  
  You shouldn't downvote just because you disagree. You should vote based on whether it's productive content.
  
  That's fine, but removing downvoting doesn't prevent the discussion. It curbs drive-by negativity which is a good thing IMO.
  Obviously everyone is free to disagree with things. It should be more than absentmindedly hitting a down arrow though. Others obviously feel differently. Thankfully both exist on Lemmy.
  
  How is downvoting essential? It doesn’t do shit.
- I want to see it per-community. We use voting for actually decision making in my instance, so we can't disable it instance-wide.
  
  That would be a useful feature. Maybe something to roll out alongside private communities and things coming in the future.
- I fully disagree, in your scenario people wouldn't realize how fucktastically bad your idea is
  Look at what removing downvotes did to youtube, you seriously want that here?

64 comments