Over a recent weekend, federated social networks such as Mastodon were the targets of a spam attack, orchestrated via Discord. Despite the coordination of these attacks through Discord servers and applications, efforts to have the facilitating server removed have been met with no success. Mastodon community leaders have struggled to make contact with Discord, highlighting a significant gap in communication and response to cybersecurity threats within these platforms.
Coordinated Attacks via Discord
Emelia Smith, a software engineer focusing on trust and safety in decentralized social networks, reported that the spam attacks were coordinated through a Discord server, exploiting bots for seamless execution without the need for separate server setups. Despite attempts to reach Discord and report the server in question since February 17, only automated responses have been received, indicating a lack of a robust system for reporting malicious servers.
Impact on Federated Networks
The spam attacks have placed a financial and operational strain on server administrators across various federated platforms, including Mastodon and Misskey. These attacks not only result in denial of service but also in significant infrastructure costs for the affected communities. Despite Discord’s statement of policy against platform abuse, the server responsible for orchestrating these attacks remains active, questioning the effectiveness of Discord’s monitoring and enforcement practices.
Challenges in Moderation and Response
Mastodon founder Eugen Rochko highlighted the difficulty in moderating these attacks, especially as they target smaller servers with limited moderation tools. The open registration on some servers exacerbates the issue, allowing attackers to create new accounts swiftly for spamming purposes. This incident sheds light on the vulnerabilities within the fediverse, particularly for decentralized networks that rely heavily on volunteer developers and moderators.
Social Dynamics and Cybersecurity Threats
The origin of this attack traces back to a dispute between teenagers on two Japanese Discord servers, demonstrating a disconnect between technological capability and maturity. This scenario, reminiscent of a significant 2016 cyberattack by teenagers with a botnet originally intended for Minecraft, underscores the unpredictable nature of cybersecurity threats and the diverse motivations behind them.
Decentralization and Its Double-Edged Sword
While Mastodon’s decentralized model offers users greater control over their social media experience, it also presents challenges in moderation and development. With a development force comprised mostly of volunteers, the platform, and the broader fediverse, face ongoing threats from such coordinated attacks without the resources for a robust defensive response.
