Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

301–310 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#301

Post by streetfighter64 »

dheera wrote: post #36
nhubbard wrote: post #18

Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page…

Wouldn't be surprised if elaborate worms like this are AI-designed

Turns out it's a pretty rudimentary XSS worm from 2023. If all you have is a hammer, everything looks like a nail; if all you have is a LLM, everything looks like slop?

Re: Wikipedia was in read-only mode following mass admin account compromise

#302

Post by canpan »

tetha wrote: post #134
Extropy_ wrote: post #103

Earlier quoted context omitted.

Even if they reset to several days ago and lose, say, thousands of edits, even tens of thousands of minor edits, they're still in a pretty good place. Losing a few days of edits is less-than-ideal but very tolerable for Wikipedia as a whole

At $work we're hosting business knowledge databases. Interestingly enough, if you need to revert a day or two of edits, you're better off to do it asap, over postponing and mulling over it. Especially if you can keep a dump or an export around. People usually remember what they changed yesterday and have uploaded files and such still around. It's not great, but quite possible. Maybe you need to pull a few content art…

I preach to everyone to fail as loudly as possible and as fast as possible. Don't try to "fix" unknown errors in code. It often catches fresh graduates off guard. If you fail very loud and fast most issues will be found asap and fixed.

I had to help out a team in the cleanup of a bug that corrupted some data silently for a while before being found. It was too long out to roll back and they needed all help to identify what was real or wrong data.

Re: Wikipedia was in read-only mode following mass admin account compromise

#303

Post by creatonez »

nhubbard wrote: post #38
dheera wrote: post #36

Earlier quoted context omitted.

Wouldn't be surprised if elaborate worms like this are AI-designed

I wouldn't be surprised either. But the original formatting of the worm makes me think it was human written, or maybe AI assisted, but not 100% AI. It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output.

> It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output.

Indeed. One of those unusual choices is that it uses jQuery. Gotta have IE6 compatibility in your worm!

I'm not sure what to make of `Number("20")` in the source code. I would think it's some way to get around some filter intended to discourage CPU-intensive looping, but I don't think user scripts have any form of automated moderation, and if that were the case it doesn't make sense that they would allow a `for` loop in the first place.

Re: Wikipedia was in read-only mode following mass admin account compromise

#304

Post by mkl »

craftkiller wrote: post #240
throw-the-towel wrote: post #217

Earlier quoted context omitted.

Namecheap is Ukrainian, of course they won't sell you a .ru domain.

Is it? Wikipedia says: > Namecheap is a U.S. based domain name registrar and web hosting service company headquartered in Phoenix, Arizona. and in 2025 they were purchased by: > CVC Capital Partners plc is a Jersey-based private equity and investment advisory firm

https://news.ycombinator.com/item?id=30504812

Top comment is from the CEO and explains: "We have people on the ground in Ukraine being bombarded now non stop."

Re: Wikipedia was in read-only mode following mass admin account compromise

#306

Post by streetfighter64 »

Dylan16807 wrote: post #298
streetfighter64 wrote: post #120

Earlier quoted context omitted.

Imagine if wikipedia was a native app, what this vuln would have caused. I for one prefer using stuff in the browser where at least it's sandboxed. Also, there's nothing stopping you from disabling JS in your browser.

If it was a native app it wouldn't be grabbing one of the hosted files and running it as code.

Have you never seen a native app's auto-update get hijacked by malware? It happened (yet again) last month [0]

Tons of native apps also have plugins or addons, which (surprise surprise) is just code downloaded from some central repo, and run with way less sandboxing than JS.

[0] https://www.bleepingcomputer.com/news/security/notepad-plus-...

Re: Wikipedia was in read-only mode following mass admin account compromise

#307

Post by dheera »

creatonez wrote: post #303
nhubbard wrote: post #38

Earlier quoted context omitted.

I wouldn't be surprised either. But the original formatting of the worm makes me think it was human written, or maybe AI assisted, but not 100% AI. It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output.

> It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output. Indeed. One of those unusual choices is that it uses jQuery. Gotta have IE6 compatibility in your worm! I'm not sure what to make of `Number("20")` in the source code. I would think it's some way to get around some filter intended to discourage CPU-intensive looping, but I don't think user scripts have any form of autom…

jQuery is still sooo much easier to use than React and whatever other messes modern frameworks have created. As a bonus, you don't have to npm build your JS project, you just double click and it opens and works without any build step, which is how interpreted languages were intended to be.

Re: Wikipedia was in read-only mode following mass admin account compromise

#308

Post by creatonez »

divbzero wrote: post #258
nhubbard wrote: post #18

Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page…

There doesn’t seem to be an ulterior motive beyond “Muahaha, see the trouble I can cause!”

No one actually knows what the payload from basemetrika.ru contains, though. So it's possible it was originally intended to be more damaging. But no matter what it would have caught attention super fast, so there's probably an upper limit to how sophisticated it could have been.

Re: Wikipedia was in read-only mode following mass admin account compromise

#309

Post by SanjayMehta »

amiga386 wrote: post #79
pKropotkin wrote: post #27

Earlier quoted context omitted.

Yeah, basemetrika.ru is free now. Should we occupy it? ;)

It means giving money to the Russian government, so no. If anyone from the Russian government is reading this, get the fuck out of Ukraine. Thank you.

"In 2023, the United States imported U3O8 and equivalents primarily from Canada, Australia, Russia, Kazakhstan, and Uzbekistan. The origin of U3O8 used in U.S. nuclear reactors could change in the coming years. In May 2024, the United States banned imports of uranium products from Russia beginning in August, although companies may apply for waivers through January 1, 2028."

https://www.eia.gov/todayinenergy/detail.php?id=64444

Post reply on HN