Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

311–320 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#311

Post by ljm »

Ferret7446 wrote: post #243
tux3 wrote: post #125

See the public phab ticket: https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly…

This is a pretty egregious failure for a staff security engineer

It's a pretty egregious failure for the org because it controlled the conditions for it to happen.

The security guy is just the patsy because he actioned it.

They have obviously done this a million times before and now they got burned.

Re: Wikipedia was in read-only mode following mass admin account compromise

#312

Post by [deleted] »

Kiboneu wrote: post #198
Imustaskforhelp wrote: post #167

Earlier quoted context omitted.

> edit: lol downvoted with no counterpoint, is it hitting a nerve? I have upvoted ya fwiw and I don't understand it either why people would try to downvote ya. I mean, if websites work for you while disabling js and you are fine with it. Then I mean JS is an threat vector somewhat. Many of us are unable to live our lives without JS. I used to use librewolf and complete and total privacy started feeling a little too u…

> I mean, if websites work for you while disabling js and you are fine with it. Then I mean JS is an threat vector somewhat It's also been torture, I definitely don't prescribe it. :P Like you say, it's a sanity / utility / security tradeoff. I just happen to be willing to trade off sanity for utility and security. And yes, unfortunately I have to enable JS for some sites -- the default is to leave it disabled. And o…

[deleted]

Re: Wikipedia was in read-only mode following mass admin account compromise

#313

Post by NBJack »

jl6 wrote: post #237
londons_explore wrote: post #140

Earlier quoted context omitted.

Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.

Letting ancient evil code run? Have we learned nothing from A Fire Upon the Deep ?!

Legitimately listening to this book for the first time after a coworker recommended it. It's rapidly becoming one of my favorite books that balances the truly alien with the familiar just right.

Not so ironically, it came up when we were discussing "software archeology".

Re: Wikipedia was in read-only mode following mass admin account compromise

#314

Post by kQq9oHeAz6wLLS »

outofpaper wrote: post #223
jacquesm wrote: post #176

Earlier quoted context omitted.

True but it does say something that such a script was able to lie dormant for so long.

Why would anyone test in production???!!!

"Everyone has a test environment. Some are lucky enough to have a separate production environment."

Re: Wikipedia was in read-only mode following mass admin account compromise

#316

Post by 12_throw_away »

jl6 wrote: post #237
londons_explore wrote: post #140

Earlier quoted context omitted.

Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.

Letting ancient evil code run? Have we learned nothing from A Fire Upon the Deep ?!

＼(＾O＾)／ zones of thought mentioned ＼(＾O＾)／

Re: Wikipedia was in read-only mode following mass admin account compromise

#317

Post by tadfisher »

foltik wrote: post #292
CloakHQ wrote: post #253

[flagged]

Stop posting this AI-generated word salad. This was an XSS attack. A malicious script was executed inside an admin’s already authenticated browser context, allowing said malicious script to place itself into public facing pages. Nothing to do with any browser fingerprinting nonsense you’re going on about.

You can report them via hn@ycombinator.com

I've seen a few obvious LLM spammers get banned minutes after reporting. Dang does good work.

Re: Wikipedia was in read-only mode following mass admin account compromise

#318

Post by sonofhans »

ljm wrote: post #311
Ferret7446 wrote: post #243

Earlier quoted context omitted.

This is a pretty egregious failure for a staff security engineer

It's a pretty egregious failure for the org because it controlled the conditions for it to happen. The security guy is just the patsy because he actioned it. They have obviously done this a million times before and now they got burned.

Yes, this. That same engineer shouldn’t have a pocket nuclear trigger shaped just like their key fob, either. Humans are predictable.

Re: Wikipedia was in read-only mode following mass admin account compromise

#319

Post by craftkiller »

mkl wrote: post #304
craftkiller wrote: post #240

Earlier quoted context omitted.

Is it? Wikipedia says: > Namecheap is a U.S. based domain name registrar and web hosting service company headquartered in Phoenix, Arizona. and in 2025 they were purchased by: > CVC Capital Partners plc is a Jersey-based private equity and investment advisory firm

https://news.ycombinator.com/item?id=30504812 Top comment is from the CEO and explains: "We have people on the ground in Ukraine being bombarded now non stop."

I'm not questioning whether or not they have Ukrainian employees, I'm questioning the statement "Namecheap is Ukrainian". That post+comment does not address that. McDonalds has employees in Vietnam but McDonalds is not Vietnamese.

Re: Wikipedia was in read-only mode following mass admin account compromise

#320

Post by j45 »

dns_snek wrote: post #262
j45 wrote: post #190

Earlier quoted context omitted.

It's not, application logic exposed on the client side is always an attack vector for figuring out how it works and how attack vectors could be devised. It's simply a calculated risk. How much business and application logic you put in your Javascript is critical. On your second unrelated comment about Wikipedia needing to use 2FA, there's probably a better way to do it and I hope mediawiki can do it.

I don't know what you mean by application logic being exposed client-side. To change the content on the website, nuke articles, and propagate the malicious JS code you need to hijack privileged users' credentials and use them to trigger server-side actions. It doesn't matter how much functionality the JS was originally responsible for, it could've been as little as updating a clock, validating forms, or just some sil…

Ah, I’m not speaking about JavaScript within the content of wikipedia as you are.

I’m referring to the use of JavaScript in general in the building of web apps themselves. My comment is the same about 2FA.

I’m making these comments from the general perspective because I see it as a security risk when front end scriptability and app logic are more available than say server side apps.

Hope that clarifies my comments.

Post reply on HN