archive.today
webpage capture
Saved from
history←priornext→
19 May 2024 20:30:36 UTC
All snapshots from host www.reddit.com
discussions in r/selfhosted
GIT ManagementMy Gitea (Forgejo) got hacked - some strange user, a very large repo (self.selfhosted)
submitted 2 days ago * by DontBuyMeGoldGiveBTC
Background: A few hours ago, while doing a routine Google search for my domain to check if I had inadvertently exposed any details online, I stumbled upon an unexpected mention of my git domain. Intrigued and alarmed, I dug deeper and discovered that an unknown user had created an account on my Gitea server.
Update: maybe not hacked, take with a pinch of salt; registrations were open with e-mail verification, but my password didn't work.
The Hack (simple account creation):
User Creation: The user, named 'O', somehow managed to activate their account in late April as if I had approved it myself. (They just verified their e-mail address.)
Repository Upload: This user uploaded a massive 4.3 GB repository with a lot update history. It was allegedly forked from https://gitea.lolumi.com/O/O (this was last updated 2 hours ago)
Password Tampering: I also found that my admin password had been changed, forcing me to reset it to log in and delete the user/repo. (Idk if it was changed, it didn't work)
On further inspection, I traced back a network of repositories all linked to this mysterious user 'O', hosted across different domains like https://git.pack.house/O/O and https://dagshub.com/O/O. Each repository is similarly structured under /O/O, and I can't for the life of me figure out why or how this user appeared in my system (seems it's just a matter of registering with the open access I didn't close). Storage network? Botnet? Full server & gitea user takeover?
Security Measures:
After resetting my password, I deleted the unauthorized user and the large repository.
I did a reverse lookup on the email address [email protected] used by 'O', which suggested this wasn't their first rodeo—there seems to be a pattern of hopping onto many domains with similar setups. I encourage you to google it yourself
Moving Forward:
I've contacted a few other site owners who might be affected based on my findings.
I'm considering purging my Forgejo instance. I don't use it much, and it seems to have been compromised.
Has anyone here experienced something similar? Any advice on further preventive measures would be greatly appreciated. I'm especially curious about any insights into stopping such sophisticated intrusions at the server level.
Thanks for any help or insights you can offer!
edit: My repository was in a list such as this one where they post all the repositories they have forked onto open access gitea instances: https://repos.itabas.com/O/O/commit/22dcc8bd6702fda980134df7c55962eea01e4156
Conclusion: don't allow ppl to register if you don't want strange people to register. Also enable e-mail notifications and stuff for events if possible.
66 comments
all 66 comments
sorted by: new
[–]macojoel13 1 point 1 day ago
Bro. I'm genuinely curious now about more info for it, like, what does it mean? If anything at all? Schizo programming? Bot? What is it!? Will we never know???
[–]DontBuyMeGoldGiveBTC[S] 2 points 23 hours ago
If you check his Instagram and a bunch of what he's posted, I think he may just be autistic or schizophrenic with an obsession with certain concepts like astral objects, photons, etc. It's pretty hard to decipher. Honestly idk what's going on through his head but yeah it seems to just be some dude going through something or doing an art project that involves uploading his shit to hundreds if not thousands of machines.
[–]thornyfunkpuppet 1 point 6 hours ago
His repo is giving me some real “Toynbee Tiles” vibes, if you’re familiar with them.
[–]macojoel13 1 point 23 hours ago
Fucking crazy, this is the kind of shit that will forever remain a mistery to the internet unless the guy comes forward himself 🤣
Crazy to think this guy has planted himself in lord knows how many machines.
[–]phein4242 1 point 1 day ago
Your network is compromised. Start with rebuilding (from scratch) everything which you cannot guarantee to be safe.
[–]PersonalSafe 4 points 1 day ago
This user also signed up on my gitea server in April! With the same email address. They didn't create the repository and nothing has happened with my password.
Erased their account just now
[–]DontBuyMeGoldGiveBTC[S] 1 point 1 day ago
Aha! I was sure if I made this post here if I'd fish out a few other cases. I'm also planning to contact a bunch of people who got this repo on their server.
Read these comments and close registrations hahah
[–]toxic_headshot132 2 points 1 day ago
Don't really understand what the ooo is but this is kind of cool if he is using multiple repos as a storage and obfuscating it in such way making it look like a alien transcript 🤣
[–]sslnx 5 points 1 day ago
Client certificate is a must if you expose your service to the internet. Just keep your root CA credentials safe, and only allowed parties will be able to establish a connection. You will definitely sleep better.
[–]DontBuyMeGoldGiveBTC[S] 3 points 1 day ago
I need to read more about this. First time I see a mention.
[–]urinesamplefrommyass 1 point 1 day ago
NetworkChuck Will probably have all tutorials you need. Here's a beginning
[–]DontBuyMeGoldGiveBTC[S] 1 point 1 day ago*
I even set up some FRP tunnels to my computer's navidrome and shit and it turns out cloudflare provides it heh. Guess I don't need a VPS after all for this.
[–]urinesamplefrommyass 1 point 1 day ago
NetworkChuck and Wolfgangs channel will probably provide most of your needs in content.
I find NetworkChuck to be best for learning... Well... Network stuff, as he explains a lot like the the video provided.
Wolfgangs is good for finding a better scale on your server needs and setting it up. He's got a very interesting video about what is he running on his server, with a great chapter (23:50 Yeeting my bootdrive and reinstalling from scratch) about an automation to reset everything and build his server from scratch with automations to bring everything back up.
[–]TurbulentGene694 1 point 1 day ago
What the fuck are those security measures? Where are your passkeys? Why is it open to the world God I don't even wanna know what other security holes you have...
[–]DontBuyMeGoldGiveBTC[S] 1 point 1 day ago
This is my only self hosted thing lol. And a closed navidrome.
[–]yeewhothis 3 points 1 day ago*
def want to turn off self registration (enable the disable self registration) might want to add all this behind a reverse proxy and then add authentication on the reverse proxy level with something like authentik so anyone accessing the site has to authenticate through this before even hitting gitea/any service
on cloudflare you can also block out entire continents, likely bots, and restrict access to only certain IPs to your site so you can block anyone on the cloudflare level before even touching your server
[–]AdrianTeri 3 points 1 day ago
Any advice on further preventive measures would be greatly appreciated.Any advice on further preventive measures would be greatly appreciated.
Anything that doesn't need public access do NOT avail it via 0.0.0.0/0. This includes ssh access!
Since we're in a tinkerers sub at least spin up a VPN server out of your home.
If you really need to expose things do your research, expose & prod them in a "sanitized" env(accessible via VPN or Localhost only), deploy them to their own sandbox & keep up/subscribe(and I mean 1st thing you wake up to) to news about the project & security bulletins.
[–]lucassou 6 points 1 day ago
Based on his fantastic Instagram account he seems Russian https://www.instagram.com/oooo_oooo.oooo_oooo?igsh=NG5sOHhwbHZ3NTZu
I wonder if he used some weird encoding format for his texts which the websites he uploaded his stuff to didn't like much
[–]neroeterno 16 points 1 day ago*
Wtf is this
Edit: and this
Edit: is it possible to decode these audios and videos? Probably has some hidden messages.
[–]dibu28 -2 points 1 day ago
Chat GPT-4O hiding itself encrypted 🤣🤣🤣
[–]Raupe_Nimmersatt 2 points 1 day ago
Da fuq? Strong r/surrealmemes vibes
[–]Bekar_vai 5 points 1 day ago*
hijacking this comment;
it seems quite a lot of forgeo instance's have the same repo, by simply googling this
for forgeo: inurl:O/O/src/branch
gitea: inurl:O/O/commit
there should be other similar repo
Edit: Found more by searching 𖣠⚪𔗢⚪𖡼⚪𔗢⚪🞋⚪𔗢⚪𖡼⚪𔗢⚪𖣠
[–]neroeterno 10 points 1 day ago*
What I understand is that this guy is bad at python and css. Uses firefox and is familiar with firefoxcss. Have no idea about 0.0.0.0 . Most likely created the weird symmetrical images with python. And he is making these shaders using sin, tan and cos in blender. He uses JetBrain products. And there is lot more details.
Edit: His influence.co profile says he is from Belarus.
[–]liggerbreek 4 points 1 day ago
There is a book about alien interviews in there as well, and some document on how to "free yourself from Microsoft and the NSA", which both seem to fit perfectly into a repo like this
[–]Djdhshsus5737 3 points 1 day ago
Super bizarre.
I think he's mentally ill. Check out his linktree style site. https://oooo.bio.link/
[–]neroeterno 3 points 1 day ago
Probably hiding some messages. Got a lot of images and videos that looks similar and audio files with wierd beeps(or something)
[–]FactoryOfShit 35 points 1 day ago
This is why Gitlab now requires credit card details to make an unrestricted account. People created bots that took user files, encrypted them, obfuscated them and then scattered them across huge gitlab repositories (with replication, so that if a bot gets banned the files aren't lost), utilizing gitlab.com's free tier as a free cloud storage (and then reselling this to people as a service).
