Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

51–60 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#51

Post by ale42 »

Dwedit wrote: post #13
256_ wrote: post #9

Here before someone says that it's because MediaWiki is written in PHP.

PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...

Except that in a contemporary PHP that doesn't work any more.

  PHP Warning:  Uncaught Error: Undefined constant "flase" in php shell code:1
This means game over, the script stops there.

Re: Wikipedia was in read-only mode following mass admin account compromise

#52

Post by dspillett »

m4tthumphrey wrote: post #16
Dwedit wrote: post #13

Earlier quoted context omitted.

PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...

Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.

> Also the language that has made me millions over my career with no degree.

Well done.

> Also the language that allows people to be up and running in seconds (with or without AI).

People getting up and running without any opportunity to be taught about security concerns (even those as simple as the risks of inadequate input verification), especially considering the infamous inconsistency in PHP's APIs which can lead to significant foot-guns, is both a blessing and a curse… Essentially a pre-cursor to some of the crap that is starting to be published now via vibe-coding with little understanding.

Re: Wikipedia was in read-only mode following mass admin account compromise

#54

Post by kbolino »

ale42 wrote: post #32
cm2012 wrote: post #12

Earlier quoted context omitted.

Wikipedia probably actively wastes $100m per year

On what? I'd be curious to read more (documented sources)

Where and how they spent their money is on p. 21 of this PDF [1] which can be obtained from this official source [2]. This is just a high-level breakdown, but it does illustrate that, for example, more than twice as much is spent on "Donation processing expenses" ($7.5M) as "Internet hosting" ($3.1M), and that the largest line item, by far, is "Salaries and benefits" ($106M).

[1]: https://wikimediafoundation.org/wp-content/uploads/2025/04/W...

[2]: https://wikimediafoundation.org/annualreports/2023-2024-annu...

Re: Wikipedia was in read-only mode following mass admin account compromise

#56

Post by 256_ »

Wikipedianon wrote: post #41

This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…

Maybe somewhat unrelated, but I'm reminded of the fact that people have deleted the main page on a few occasions: https://en.wikipedia.org/wiki/Wikipedia:Don%27t_delete_the_m...

Re: Wikipedia was in read-only mode following mass admin account compromise

#57

Post by bawolff »

0xWTF wrote: post #47
devmor wrote: post #30

In the early 2010’s I worked for a company whose primary income was subscriptions to site protection services - one of which included cleaning up malware-infected Wordpress installations. I worked on the team that did this job. This exact type of database-stored executable javascript was one of the most annoying types of infections to clean up.

Ok, so there are tons of mediawiki installations all over the internet. What do these operators do? Set their wikis to read-only mode, hang tight, and wait for a security patch? Also, does this worm have a name?

There is nothing to do, the incident was not caused by a vulnerability in mediawiki.

Basically someone who had permissions to alter site js, accidentally added malicious js. The main solution is to be very careful about giving user accounts permission to edit js.

[There are of course other hardening things that maybe should be done based on lessons learned]

Re: Wikipedia was in read-only mode following mass admin account compromise

#59

Post by speedgoose »

256_ wrote: post #37
pKropotkin wrote: post #27

Earlier quoted context omitted.

Yeah, basemetrika.ru is free now. Should we occupy it? ;)

I'm half-tempted to try and claim it myself for fun and profit, but I think I'll leave it for someone else. What should we put there, anyway?

A JavaScript call to window.alert to pause the JavaScript VM.

Re: Wikipedia was in read-only mode following mass admin account compromise

#60

Post by [deleted] »

m4tthumphrey wrote: post #16
Dwedit wrote: post #13

Earlier quoted context omitted.

PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...

Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.

[deleted]
Post reply on HN