Here before someone says that it's because MediaWiki is written in PHP.
PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...
FWIW this was fixed in 2020
Wikipedia was in read-only mode following mass admin account compromise
21–30 of 405 posts
Re: Wikipedia was in read-only mode following mass admin account compromise
#22Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page…
As someone on the Wikipediocracy forums pointed out, basemetrika.ru does not exist. I get an NXDomain response trying to resolve it. The plot thickens.
Re: Wikipedia was in read-only mode following mass admin account compromise
#23[flagged]
Re: Wikipedia was in read-only mode following mass admin account compromise
#24Earlier quoted context omitted.
PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...
Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.
Yep, that's the sad truth - a language popularity often has nothing to do with it's security properties. People will happily keep churning out insecure junk as long as it makes them millions, botnet and data compromises be damned.
Re: Wikipedia was in read-only mode following mass admin account compromise
#25[flagged]
"The Wikimedia Foundation, which operates Wikipedia, reported a total revenue of $185.4 million for the 2023–2024 fiscal year (ending June 2024). The majority of this funding comes from individual donations, with additional income from investments and the Wikimedia Enterprise commercial API service." (Unless this was satire and I missed it)
What's the operating budget for other websites with comparable traffic? Without context $185 million seems like a lot, but compared to what? Reddit's operating budget for the same timeframe was $1.86 billion.
Re: Wikipedia was in read-only mode following mass admin account compromise
#26Woah this looks like an old school XSS worm https://meta.wikimedia.org/wiki/Special:RecentChanges?hidebo... I’ve always thought the fact that MediaWiki sometimes lets editors embed JavaScript could be dangerous.
Also, I’m also surprised an XSS attack like hasn’t yet been actually used to harvest credentials like passwords through browser autofill[0]. It seems like the worm code/the replicated code only really attacks stuff on site. But leaking credentials (and obviously people reuse passwords across sites) could be sooo much worse. [0] https://varun.ch/posts/autofill/
Time to add 2FA...
Re: Wikipedia was in read-only mode following mass admin account compromise
#27Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page…
As someone on the Wikipediocracy forums pointed out, basemetrika.ru does not exist. I get an NXDomain response trying to resolve it. The plot thickens.
Yeah, basemetrika.ru is free now. Should we occupy it? ;)
Re: Wikipedia was in read-only mode following mass admin account compromise
#28How do they know? Has this been published in a Reliable Source?
Re: Wikipedia was in read-only mode following mass admin account compromise
#29[flagged]
care to elaborate?
Re: Wikipedia was in read-only mode following mass admin account compromise
#30In the early 2010’s I worked for a company whose primary income was subscriptions to site protection services - one of which included cleaning up malware-infected Wordpress installations. I worked on the team that did this job.
This exact type of database-stored executable javascript was one of the most annoying types of infections to clean up.