Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

11–20 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#14
post #6

[flagged]

They are rather well funded for a non-profit and the reserves in the endowment fund are very healthy:

https://en.wikipedia.org/wiki/Wikipedia:Fundraising_statisti...

https://wikimediafoundation.org/who-we-are/financial-reports...

Re: Wikipedia was in read-only mode following mass admin account compromise

#15

Additional context: https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555 https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(techni... https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathre... Apparent JS worm payload: https://ru.wikipedia.org/w/index.php?title=%D0%A3%D1%87%D0%B...

Wikipediocracy link gives "not authorized".

Re: Wikipedia was in read-only mode following mass admin account compromise

#16
post #13
post #9

Here before someone says that it's because MediaWiki is written in PHP.

PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...

Also the language that runs half of the web.

Also the language that has made me millions over my career with no degree.

Also the language that allows people to be up and running in seconds (with or without AI).

I could go on.

Re: Wikipedia was in read-only mode following mass admin account compromise

#17
post #13

Earlier quoted context omitted.

PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...

Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.

PHP is a fine language. It started my career. That said, it has a lot of baggage that can let you shoot yourself in the foot. Modern PHP is pretty awesome though.

Re: Wikipedia was in read-only mode following mass admin account compromise

#18
Wow. This worm is fascinating. It seems to do the following:

- Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback

- Uses jQuery to hide UI elements that would reveal the infection

- Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru

- If an admin is infected, it will use the Special:Nuke page to delete 3 random articles from the global namespace, AND use the Special:Random with action=delete to delete another 20 random articles

EDIT! The Special:Nuke is really weird. It gets a default list of articles to nuke from the search field, which could be any group of articles, and rubber-stamps nuking them. It does this three times in a row.

Post reply on HN