Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

291–300 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#291

Post by ghxst »

withinboredom wrote: post #281
ninth_ant wrote: post #244

Earlier quoted context omitted.

Selecting the wrong environment in your test setup by mistake? I refuse to believe that someone on the security team intentionally tested random user scripts in production on purpose.

Once you get big enough… there comes a point where you need to run some code and learn what happens when 100 million people hitting it at once looks like. At that scale, “1 in a million class bugs/race conditions” literally happen every day. You can’t do that on every PR, so you ship it and prepare to roll back if anything even starts to look fishy. Maybe even just roll it out gradually. At least, that’s how it worke…

I would say you can get to this point far below 100 million people, especially on web. Some people are truly special and have some kind of setup you just can't easily reproduce. But I agree, you do really have to be confident in your ability to control rollout / blast radius, monitor and revert if needed.

Re: Wikipedia was in read-only mode following mass admin account compromise

#292

Post by foltik »

CloakHQ wrote: post #253

[flagged]

Stop posting this AI-generated word salad.

This was an XSS attack. A malicious script was executed inside an admin’s already authenticated browser context, allowing said malicious script to place itself into public facing pages. Nothing to do with any browser fingerprinting nonsense you’re going on about.

Re: Wikipedia was in read-only mode following mass admin account compromise

#293

Post by bawolff »

dboreham wrote: post #102
bawolff wrote: post #57

Earlier quoted context omitted.

There is nothing to do, the incident was not caused by a vulnerability in mediawiki. Basically someone who had permissions to alter site js, accidentally added malicious js. The main solution is to be very careful about giving user accounts permission to edit js. [There are of course other hardening things that maybe should be done based on lessons learned]

There are already tools and techniques to validate served JS is as-intended, and these techniques could be beefed up by adding browser checks. I've been surprised these haven't been widely adopted given the spate of recent JS-poisoning attacks.

You mean like SRI? That's not really what happened here, so its not really relavent.

Re: Wikipedia was in read-only mode following mass admin account compromise

#294

Post by cesarb »

i_think_so wrote: post #85

> Hitting MediaWiki:Common.js is the absolute nightmare scenario for MediaWiki deployments because that script gets executed by literally every single visitor ...except for us security wonks who have js turned off by default, don't enable it without good reason, disable it ASAP, and take a dim view of websites that require it. Not too many years ago this behavior was the domain of Luddites and schizophrenics. Today i…

> and see if, maybe just maybe, they can get by without js.

Unless it changed recently (it's too slow right now for me to check), Wikipedia has always worked perfectly fine without JS; that includes even editing articles (using the classic editor which shows the article markup directly, instead of the newer "visual" editor).

Edit: I just checked, and indeed I can still open the classic edit page even with JS blocked.

Re: Wikipedia was in read-only mode following mass admin account compromise

#296

Post by tonymet »

worksonmine wrote: post #152
mafriese wrote: post #121

I’m not saying that this is related to Wikipedia ditching archive.is but timing in combination with Russian messages is at least…weird.

And they probably used mind-control to make the admin run random userscripts on his privileged account as well, the capabilities of russian hackers is scary. /s It is just another human acting human again.

Admin tasks are public in phabricator so it would be trivial to review chores and place malware in the chore's scope

Re: Wikipedia was in read-only mode following mass admin account compromise

#297

Post by Wikipedianon »

gucci-on-fleek wrote: post #228
Wikipedianon wrote: post #41

This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…

> Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. True, but there aren't very many interface administrators. It looks like there are only 137 right now [0], which I agree is probably more than there should be, but that's still a relatively small number compared to the total number of active users. But there are lots of bots/duplicates in…

There shouldn't be any interface admins as such. There should be an enforced review process for changes to global JavaScript so stuff like this can't happen.

I'm sure there are Google engineers who can push changes to prod and bypass CI but that isn't a normal way to handle infra.

Re: Wikipedia was in read-only mode following mass admin account compromise

#298

Post by Dylan16807 »

streetfighter64 wrote: post #120
dgxyz wrote: post #68

Earlier quoted context omitted.

This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...

Imagine if wikipedia was a native app, what this vuln would have caused. I for one prefer using stuff in the browser where at least it's sandboxed. Also, there's nothing stopping you from disabling JS in your browser.

If it was a native app it wouldn't be grabbing one of the hosted files and running it as code.

Re: Wikipedia was in read-only mode following mass admin account compromise

#299

Post by justsomehnguy »

craftkiller wrote: post #240
throw-the-towel wrote: post #217

Earlier quoted context omitted.

Namecheap is Ukrainian, of course they won't sell you a .ru domain.

Is it? Wikipedia says: > Namecheap is a U.S. based domain name registrar and web hosting service company headquartered in Phoenix, Arizona. and in 2025 they were purchased by: > CVC Capital Partners plc is a Jersey-based private equity and investment advisory firm

It is. Just punch it's name in the search box down below.

Re: Wikipedia was in read-only mode following mass admin account compromise

#300

Post by streetfighter64 »

AlienRobot wrote: post #245
tux3 wrote: post #125

See the public phab ticket: https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly…

On one hand, I was about to get irrationally angry someone was attacking Wikipedia, so I'm a bit relieved On the other hand, >a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly-privileged Wikimedia Foundation staff account seriously?

To paraphrase Bush,

> our enemies are innovative and resourceful, and so are we. They never stop thinking about new ways to harm our site and our users, and neither do we.

Post reply on HN