341–350 of 405 posts
Earlier quoted context omitted.
Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.
Letting ancient evil code run? Have we learned nothing from A Fire Upon the Deep ?!
The Mummy?
Earlier quoted context omitted.
There's a little throwaway thing in the book (or maybe it was in the prequel) that I always liked, re understanding human tendencies. They're still using Unix time, starting in Jan 1st 1970, but given that their culture is so space-travel-focused they assume the early humans set it to coincide with man's first trip to the moon.
That's from the prequel, A Deepness in the Sky . (Which is also excellent.)
Fantasy sometimes does this better but usually with specific tropes.
Earlier quoted context omitted.
Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.
Are you sure? Are you $150 million ARR sure? Are you $150 million ARR, you'd really like to keep your job, you're not going to accidentally leave a hole or blow up something else, sure? I agree, mostly, but I'm also really glad I don't have to put out this fire. Cheering them on from the sidelines, though!
> Cleaning this up is going to be an absolute forensic nightmare for the Wikimedia team since the database history itself is the active distribution vector. Well, worm didn't get root -- so if wikimedia snapshots or made a recent backup, probably not so much of a nightmare? Then the diffs can tell a fairly detailed forensic story, including indicators of motive. Snapshotting is a very low-overhead operation, so you c…
This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…
Earlier quoted context omitted.
I had looked into its availability too just out of curiosity itself before reading your comment on a provider, Then I read your comment. Atleast its taken in from the hackernews community and not a malicious actor. Do keep us updated on the whole situation if any relevant situation can happen from your POV perhaps. I'd suggest to give the domain to wikipedia team as they might know what could be the best use case of…
Not quite sure which channels I should reach out via but I've put my email on the page so they can contact me. Based on timings, it seems that Wikipedia wasn't really at risk from the domain being bought as everything was resolved before NS records could propagate. I got 1 hit from the URL which would've loaded up the script and nothing since.
Earlier quoted context omitted.
Wouldn't be surprised if elaborate worms like this are AI-designed
I would. AI designed software in general does not include novel ideas. And this is the kind of novel software AI is not great at, because there's not much training data. Of course it's very possible someone wrote it with AI help. But almost no chance it was designed by AI.
This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…
You're mixing up events. Superprotect is unrelated to the IAdmin separation from normal admin. The two are separated by many years and basically totally unrelated.
I agree with the rest of your post.
See the public phab ticket: https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly…
wait as a wikipedia user you can just put random JS to some settings and it will just... run? privileged? this is both really cool and really really insane
And when you have enough rights, you get to add arbitrary code to everywhere on your site.