Kiwi Farms Hacked: Hacker gains access to the administrator account

Basically, it was only a matter of time: The hater forum Kiwi Farms was hacked. The operator warned users that intruders had gained access to its administrator account – with the corresponding consequences. Kiwi Farm is a forum in which mainly people cavort who want to carry out violent hate campaigns against trans people or who are doing so. It goes so far that the community celebrated having already driven several people to suicide.

The hustle and bustle on the site went way too far even for companies like Cloudflare, which actually protect everyone from attacks. The site has had problems lately because it wasn’t even tolerated in Russia. Originally, the operator Joshua Moon spoke of giving up the site entirely. However, the forum is no longer online and visitors are informed that the site has been hacked.

Registered users should assume that their stored email addresses, the password database and the IP addresses used to visit the platform in the last few weeks have fallen into the hands of the attackers. The administrator now announced that he wants to restore the forum from backups. However, he has not yet given a date when the site should go online again. However, this will probably not happen very quickly, since he wants to rethink security from the ground up – after all, such an incident should not happen again.

The Session cookie was stolen

However, the hack itself was not caused by an error on the part of the operator. Security researcher Kevin Beaumont confirmed that Moon seems to know exactly what he’s doing. “Unfortunately for him, this does not apply to the companies he works with, nor to the users,” the expert explained.

The attackers ultimately succeeded in uploading a manipulated file to an external service provider and embedding it in the forum. Session cookies could then be hijacked via these. In this way, the attacker also got hold of the administrator’s currently valid token and was able to take over his account.