Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

271–280 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#271

Post by bawolff »

karel-3d wrote: post #210
hk__2 wrote: post #205

Earlier quoted context omitted.

Yes, you can have your own JS/CSS that’s injected in every page. This is pretty useful for widgets, editing tools, or to customize the website’s apparence.

It sounds very dangerous to me but who am I to judge.

It is kind of risky - you now have an entire, mostly unreviewed, ecosystem of javascript code, that users can experiment with.

However its been really useful to allow power users to customize the interface to their needs. It also is sort of a pressure release for when official devs are too slow for meeting needs. At this point wikipedia has become very dependent on it.

Re: Wikipedia was in read-only mode following mass admin account compromise

#272

Post by Melatonic »

londons_explore wrote: post #140
tux3 wrote: post #125

See the public phab ticket: https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly…

Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.

Or just restore from backup across the board. Assuming they do their backups well this shouldn't be too hard (especially since its currently in Read Only mode which means no new updates)

Re: Wikipedia was in read-only mode following mass admin account compromise

#273

Post by bawolff »

Kiboneu wrote: post #89

> Cleaning this up is going to be an absolute forensic nightmare for the Wikimedia team since the database history itself is the active distribution vector. Well, worm didn't get root -- so if wikimedia snapshots or made a recent backup, probably not so much of a nightmare? Then the diffs can tell a fairly detailed forensic story, including indicators of motive. Snapshotting is a very low-overhead operation, so you c…

Nothing was rolled back in the db sense, i think people just used normal wiki revert tools.

It also never effected wikipedia, just the smaller meta site (used for interproject coordination)

Re: Wikipedia was in read-only mode following mass admin account compromise

#274

Post by xeromal »

radicaldreamer wrote: post #269
mcmcmc wrote: post #250

Earlier quoted context omitted.

Pretty much the definition of a “career limiting event”

Nobody is going to know who did this, so probably not career limiting in any major way.

They named him in the support ticket linked here somewhere.

> sbassett

Re: Wikipedia was in read-only mode following mass admin account compromise

#275

Post by dgxyz »

krisoft wrote: post #266
skrtskrt wrote: post #48

Long past time to eliminate JavaScript from existence

You will have a long trek to do that. We have a javascript interpreter deployed at the second Sun-Earth Lagrange point. https://www.theverge.com/2022/8/18/23206110/james-webb-space...

I live happily in the knowledge that in 20000 years when that eventually drifts off into another system and is picked up by aliens that they will reverse engineer it and wonder why the fuck '5'-'4'=1

Re: Wikipedia was in read-only mode following mass admin account compromise

#276

Post by notRobot »

gucci-on-fleek wrote: post #228
Wikipedianon wrote: post #41

This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…

> Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. True, but there aren't very many interface administrators. It looks like there are only 137 right now [0], which I agree is probably more than there should be, but that's still a relatively small number compared to the total number of active users. But there are lots of bots/duplicates in…

There are 15 interface admins as per these links

https://en.wikipedia.org/wiki/Wikipedia:Interface_administra...

https://en.wikipedia.org/wiki/Special:ListUsers/interface-ad...

Re: Wikipedia was in read-only mode following mass admin account compromise

#277

Post by modderation »

mcmcmc wrote: post #250
Ferret7446 wrote: post #243

Earlier quoted context omitted.

This is a pretty egregious failure for a staff security engineer

Pretty much the definition of a “career limiting event”

It's either a a Career Limiting Event, or a Career Learning event.

In the case of a Learning event, you keep your job, and take the time to make the environment more resilient to this kind of issue.

In the case of a Limiting event, you lose your job, and get hired somewhere else for significantly better pay, and make the new environment more resilient to this kind of issue.

Hopefully the Wikimedia foundation is the former.

Re: Wikipedia was in read-only mode following mass admin account compromise

#278

Post by gucci-on-fleek »

notRobot wrote: post #276
gucci-on-fleek wrote: post #228

Earlier quoted context omitted.

> Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. True, but there aren't very many interface administrators. It looks like there are only 137 right now [0], which I agree is probably more than there should be, but that's still a relatively small number compared to the total number of active users. But there are lots of bots/duplicates in…

There are 15 interface admins as per these links https://en.wikipedia.org/wiki/Wikipedia:Interface_administra... https://en.wikipedia.org/wiki/Special:ListUsers/interface-ad...

Those are the English Wikipedia-only users, but you also need to include the "global" users (which I think were the source of this specific compromise?). Search this page [0] for "editsitejs" to see the lists of global users with this permission.

[0]: https://en.wikipedia.org/wiki/Special:GlobalGroupPermissions

Re: Wikipedia was in read-only mode following mass admin account compromise

#279

Post by _k2vp »

Freak_NL wrote: post #241
Imustaskforhelp wrote: post #158

Earlier quoted context omitted.

I had looked into its availability too just out of curiosity itself before reading your comment on a provider, Then I read your comment. Atleast its taken in from the hackernews community and not a malicious actor. Do keep us updated on the whole situation if any relevant situation can happen from your POV perhaps. I'd suggest to give the domain to wikipedia team as they might know what could be the best use case of…

This community has no malicious actors? :)

I'm not malicious at least :)

Pretty public with who I am https://duti.dev/

Re: Wikipedia was in read-only mode following mass admin account compromise

#280

Post by _lvbh »

Imustaskforhelp wrote: post #158
_lvbh wrote: post #143

Earlier quoted context omitted.

I registered it about 40 minutes ago, but it seems the DNS has been cached by everyone as a result of the wikipedia hack & not even the NS is propagating. Can't get an SSL certificate .

I had looked into its availability too just out of curiosity itself before reading your comment on a provider, Then I read your comment. Atleast its taken in from the hackernews community and not a malicious actor. Do keep us updated on the whole situation if any relevant situation can happen from your POV perhaps. I'd suggest to give the domain to wikipedia team as they might know what could be the best use case of…

Not quite sure which channels I should reach out via but I've put my email on the page so they can contact me.

Based on timings, it seems that Wikipedia wasn't really at risk from the domain being bought as everything was resolved before NS records could propagate. I got 1 hit from the URL which would've loaded up the script and nothing since.

Post reply on HN