Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

281–290 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#281

Post by withinboredom »

ninth_ant wrote: post #244
outofpaper wrote: post #223

Earlier quoted context omitted.

Why would anyone test in production???!!!

Selecting the wrong environment in your test setup by mistake? I refuse to believe that someone on the security team intentionally tested random user scripts in production on purpose.

Once you get big enough… there comes a point where you need to run some code and learn what happens when 100 million people hitting it at once looks like. At that scale, “1 in a million class bugs/race conditions” literally happen every day. You can’t do that on every PR, so you ship it and prepare to roll back if anything even starts to look fishy. Maybe even just roll it out gradually.

At least, that’s how it worked at literally every big company I worked at so far. The only reason to hold it back is during testing/review. Once enough humans look at it, you release and watch metrics like a hawk.

And yeah, many features were released this way, often gated behind feature flags to control roll out. When I refactored our email system that sent over a billion notifications a month, it was nerve wracking. You can’t unsend an email and it would likely be hundreds of millions sent before we noticed a problem at scale.

Re: Wikipedia was in read-only mode following mass admin account compromise

#282

Post by cesarb »

tux3 wrote: post #125

See the public phab ticket: https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly…

> One of those random scripts was a 2 year old malicious script from ruwiki. This script injects itself in the global Javascript on every page, and then in the userscripts of any user that runs into it, so it started spreading and doing damage really fast.

So, like the Samy worm? (https://en.wikipedia.org/wiki/Samy_%28computer_worm%29)

Re: Wikipedia was in read-only mode following mass admin account compromise

#283

Post by batiudrami »

divbzero wrote: post #258
nhubbard wrote: post #18

Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page…

There doesn’t seem to be an ulterior motive beyond “Muahaha, see the trouble I can cause!”

A classical virus, from the good old days. None of this botnet/bitcoin mining in the background nonsense.

Re: Wikipedia was in read-only mode following mass admin account compromise

#284

Post by throw-the-towel »

craftkiller wrote: post #240
throw-the-towel wrote: post #217

Earlier quoted context omitted.

Namecheap is Ukrainian, of course they won't sell you a .ru domain.

Is it? Wikipedia says: > Namecheap is a U.S. based domain name registrar and web hosting service company headquartered in Phoenix, Arizona. and in 2025 they were purchased by: > CVC Capital Partners plc is a Jersey-based private equity and investment advisory firm

I remember that in 2022 a sizeable part of their workforce was located in Ukraine. Too lazy to search for proof, sorry!

Re: Wikipedia was in read-only mode following mass admin account compromise

#285

Post by [deleted] »

m4tthumphrey wrote: post #16
Dwedit wrote: post #13

Earlier quoted context omitted.

PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...

Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.

[deleted]

Re: Wikipedia was in read-only mode following mass admin account compromise

#286

Post by diath »

RGamma wrote: post #172
Wikipedianon wrote: post #41

This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…

Seems like a good time to donate one's resources to fix it. The internet is super hostile these days. If Wikipedia falls... well...

They have 100s of millions USD, they will be fine: https://upload.wikimedia.org/wikipedia/foundation/3/3f/Wikim... (page 5-7).

Re: Wikipedia was in read-only mode following mass admin account compromise

#287

Post by cesarb »

bawolff wrote: post #214
streetfighter64 wrote: post #75

Earlier quoted context omitted.

Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability. Maybe it wasn't in the early 2000s, but unencrypted HTTP was also normal then.

That's a fair point, but keep in mind normal admin is not sufficient. For local users (the account in question wasn't local) you need to be an "interface admin", of which there are only 15 on english wikipedia. The account in question had "staff" rights which gave him basically all rights on all wikis.

> For local users (the account in question wasn't local) you need to be an "interface admin", of which there are only 15 on english wikipedia.

It used to be all "admin" accounts, of which there were many more. Restricting it to "interface admin" only is a fairly recent change.

Re: Wikipedia was in read-only mode following mass admin account compromise

#288

Post by the_af »

modderation wrote: post #277
mcmcmc wrote: post #250

Earlier quoted context omitted.

Pretty much the definition of a “career limiting event”

It's either a a Career Limiting Event, or a Career Learning event. In the case of a Learning event, you keep your job, and take the time to make the environment more resilient to this kind of issue. In the case of a Limiting event, you lose your job, and get hired somewhere else for significantly better pay, and make the new environment more resilient to this kind of issue. Hopefully the Wikimedia foundation is the f…

In the average real world, the staff engineer learns nothing, regardless of whether they get to lose or keep their job. Some time down the line, they make other careless mistakes. Eventually they retire, having learned nothing.

This is more common than you'd think.

Re: Wikipedia was in read-only mode following mass admin account compromise

#289

Post by tonymet »

jibal wrote: post #230
shevy-java wrote: post #90

This is unfortunate that Wikipedia is under attack. It seems as if there are more malicious actors now than, say, 5 years ago. This may be unrelated but I also noticed more attacks on e. g. libgen, Anna's archive and what not. I am not at all saying this is similar to Wikipedia as such, mind you, but it really seems as if there are more actors active now who target people's freedom now (e. g. freedom of choice of acc…

Wikipedia is not under attack. Some stupid admin running with full privileges unsandboxed ran a test that grabbed and ran random user scripts, and one of them just happened to be this 2 year old malicious script.

that's a common attack vector -- like leaving malware usb sticks on the ground, knowing an admin will pick it up and insert it.

Phabricator reveals the ops tasks that WMF admins perform, so attackers can drop malware in common locations and bet on them getting run from time to time.

Re: Wikipedia was in read-only mode following mass admin account compromise

#290

Post by tonymet »

It's Wikipedia's 25th birthday but their security discipline is still very much circa 2001. No code signing, BOM / supply chain security. Only recently activated 2fa for admins (after another breach). Most admins are anons.

Let's hope they allocate more of the $200M+ / year to security infra.

Post reply on HN