Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

261–270 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#261

Post by Lockal »

orbital-decay wrote: post #131
wikiperson26 wrote: post #65

A theory on phab: "Some investigation was made in Russian Wikipedia discord chat, maybe it will be useful. 1. In 2023, vandal attacks was made against two Russian-language alternative wiki projects, Wikireality and Cyclopedia. Here https://wikireality.ru/wiki/РАОрг is an article about organisators of these attacks. 2. In 2024, ruwiki user Ololoshka562 created a page https://ru.wikipedia.org/wiki/user:Ololoshka562/tes…

I remember someone mass-defacing the ruwiki almost exactly a year ago (March 3 2025) with some immature insults towards certain ruwiki admins. If I'm not mistaken it was a similar method.

No, I think you are mixing something.

- There are constant deface incidents caused by editing of unprotected / semiprotected templates

- There were incidents of UI mistranslation (because MediaWiki translation is crowdsourced)

- The attack that was applied is well know in Russian community, it is pretty much standard "admin-woodpecker". The standard woodpecker (some people call it neo-woodpecker) renamed all pages with a high speed (I know this since 2007, the name woodpecker appeared many years later); then MediaWiki added throttling for renames; then neo-woodpecker reappeared in different years (usually associated with throttling bypass CVEs). Early admin-woodpeckers were much more destructive (destroyed a dozens of mediawiki websites due to lack of backups). Nuking admin woodpecker it quite a boring one, but I think (I hope) there are some AbuseFilter guardrails configured to prevent complex woodpeckers.

- The attack initiator is 100% a well known user; there are not too many users who applied woodpecker in the first place; not too many "upyachka" fans (which indicates that user edited before 2010 - back then active editors knew each other much better). But it is quite pointless to discuss who exactly the initiator is.

- Wikireality page is hijacked by a small group and does not represent the reality.

Re: Wikipedia was in read-only mode following mass admin account compromise

#262

Post by dns_snek »

j45 wrote: post #190
dns_snek wrote: post #83

Earlier quoted context omitted.

The amount of javascript is really beside the point here. The problem is that privileged users can easily edit the code without strong 2FA, allowing automatic propagation.

It's not, application logic exposed on the client side is always an attack vector for figuring out how it works and how attack vectors could be devised. It's simply a calculated risk. How much business and application logic you put in your Javascript is critical. On your second unrelated comment about Wikipedia needing to use 2FA, there's probably a better way to do it and I hope mediawiki can do it.

I don't know what you mean by application logic being exposed client-side. To change the content on the website, nuke articles, and propagate the malicious JS code you need to hijack privileged users' credentials and use them to trigger server-side actions.

It doesn't matter how much functionality the JS was originally responsible for, it could've been as little as updating a clock, validating forms, or just some silly animation. Once that JS executes in your browser it has access to your cookies and local storage, which means it can trigger whichever server-side actions it wants.

My second comment is not unrelated. The root cause of this mess is the fact that JS can be edited by privileged users without an approval process. If every change to the JS code required the user to enter their 2FA code (TOTP, let's say) then there would be no way for the worm to spread whenever users visited a page.

Re: Wikipedia was in read-only mode following mass admin account compromise

#263

Post by dns_snek »

j45 wrote: post #191
dns_snek wrote: post #101

Earlier quoted context omitted.

If they required 2FA every time you wanted to modify JS then it couldn't propagate automatically. Just requiring 2FA when you first log in wouldn't help, of course.

2FAs also may require a level of KYC that Wikipedia isn't after and advocating for 2FA might indirectly advocate for a lot more things than just 2FA.

KYC? I'm talking about standard 2FA methods like Time-based OTP codes.

Re: Wikipedia was in read-only mode following mass admin account compromise

#264

Post by xvector »

mcmcmc wrote: post #250
Ferret7446 wrote: post #243

Earlier quoted context omitted.

This is a pretty egregious failure for a staff security engineer

Pretty much the definition of a “career limiting event”

They'll be fine, recruiters don't look this stuff up and generally background checks only care about illegal shit.

Re: Wikipedia was in read-only mode following mass admin account compromise

#265

Post by varenc »

jl6 wrote: post #237
londons_explore wrote: post #140

Earlier quoted context omitted.

Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.

Letting ancient evil code run? Have we learned nothing from A Fire Upon the Deep ?!

Link to the Prologue of Fire Upon the Deep: https://www.baen.com/Chapters/-0812515285/A_Fire_Upon_the_De...

It's very short and from one of my favorite books. Increasingly relevant.

Re: Wikipedia was in read-only mode following mass admin account compromise

#266

Post by krisoft »

skrtskrt wrote: post #48

Long past time to eliminate JavaScript from existence

You will have a long trek to do that. We have a javascript interpreter deployed at the second Sun-Earth Lagrange point.

https://www.theverge.com/2022/8/18/23206110/james-webb-space...

Re: Wikipedia was in read-only mode following mass admin account compromise

#267

Post by Lockal »

infinitewars wrote: post #135

A comment from my wiki-editor friend: "The incident appears to have been a cross-site scripting hack. The origin of rhe malicious scripts was a userpage on the Russian Wikipedia. The script contained Russian language text. During the shutdown, users monitoring [https://meta.wikimedia.org/wiki/special:RecentChanges Recent changes page on Meta] could view WMF operators manually reverting what appeared to be a worm prop…

Why do you think it was faked? It is a well known Russian tech (woodpecker), the earliest version I can find now was created in 2013 (but I personally saw it in 2007), it is a well known Russian damocles sword against misconfigured MediaWiki websites.

Re: Wikipedia was in read-only mode following mass admin account compromise

#268

Post by dgxyz »

dlivingston wrote: post #227
dgxyz wrote: post #180

Earlier quoted context omitted.

I think it will change. The entire web is built on geopolitical stability and cooperation. That is no longer certain. We already have supply chains failing (RAM/storage) meaning that we will be hardware constrained for the foreseeable future. That puts the onus on efficiency and web apps are NOT efficient however we deliver them. People are also now very concerned about data sovereignty whereas they previously were n…

I think on a high level we're in agreement then. All of those points you mentioned are constraints. > "VC / SaaS / cloud industry is about to get hit very very hard via ... regulation" can you explain?

Why? Well mostly due to the unpredictable behaviour of the country which seems to have the control points of most infra these days.

How? Well the numerous non-US sovereign technology initiatives are going to be incentivised through regulation with local compliance being the only option going forwards.

As a non-US person I am already speaking to people at other orgs in similar space as ours who are looking at options there.

Re: Wikipedia was in read-only mode following mass admin account compromise

#269

Post by radicaldreamer »

mcmcmc wrote: post #250
Ferret7446 wrote: post #243

Earlier quoted context omitted.

This is a pretty egregious failure for a staff security engineer

Pretty much the definition of a “career limiting event”

Nobody is going to know who did this, so probably not career limiting in any major way.

Re: Wikipedia was in read-only mode following mass admin account compromise

#270

Post by xeromal »

jl6 wrote: post #237
londons_explore wrote: post #140

Earlier quoted context omitted.

Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.

Letting ancient evil code run? Have we learned nothing from A Fire Upon the Deep ?!

I love that book
Post reply on HN