40 ms·
Malicious attack on Wikipedia – what we know and what we’re doing
- lolc 7y agoNote: The short blurb doesn't say anything about the nature of the attack.
- vortico 7y agoJust like trying to set your local public library on fire. There are always crazies in the world.
- keymone 7y agoThere’s lots of dirty politics on WP. Not sure about other countries, but Russian government is very involved in whitewashing it’s activities.
- tempguy9999 7y agoHow interesting. Could you post some evidence? Thanks!
- toxik 7y agoExtraordinary claims require extraordinary evidence, so by that symmetry this shouldn’t require much evidence.
- d0mine 7y agoif something is repeated a lot, it doesn't make it true. Though it does make it more believable to common folk according to Goebbels https://www.azquotes.com/author/5626-Joseph_Goebbels https://www.azquotes.com/author/5626-Joseph_Goebbels
- Kaiyou 7y agoAlso, Napoleon. Repetition is really effective.
- toxik 7y agoRussian fake news is widespread and easy to find. How can this be controversial, and even downvoted on HN of all places? Russian military shot down a plane full of politicians over Ukraine, and boldly lied about it in the international press. This is just one of literally hundreds of such instances. Russia has been caught numerous times trying to sway elections across the world. How on earth is “Russia whitewashes its name on wikipedia” needing substantiation? It seems obvious, even.
- keymone 7y agoplane full of civilians you mean? plane full of politicians crashed over russian territory in 2010.
- keymone 7y agoHere you go: https://ru.m.wikipedia.org/wiki/Википедия:К_оценке_источников#Некоторые_сайты,_связанные_с_РИА_ФАН https://ru.m.wikipedia.org/wiki/Википедия:К_оценке_источнико... Edit: also https://www.the-village.ru/village/city/news-city/358231-spam-list https://www.the-village.ru/village/city/news-city/358231-spa...
- Chris_Chambers 7y agoOh, look. It’s a redditor.
- cycloptic 7y agoYou can't grow a non-profit that large without angering someone. There will always be folks who believe they are more deserving of the "free money."
- tempguy9999 7y agoSome people just like to break things. It's that simple.
- mistrial9 7y agoexcept, mental states are perhaps less stable than physical ones, ultimately, and using a 'web site' is largely a mental model on the part of the user, while a technical model on the part of the provider. Dysfunctional mental drivers + lots of access + lots of time .. versus a door that locks each night and an alert attendant or three.. This is dismaying but not shocking.. the first time I saw a newly planted tree on an otherwise bleak urban block, vandalized and broken, I realized that a drive towards "better" is not to be taken for granted, and needs protection.
- RyanAF7 7y agoOr maybe stop planting trees if your people are so ignored and powerless they feel the need to destroy it.
- dleslie 7y agoThere was a string of arson attacks on little free libraries in Metro Vancouver; eventually a pair of teenage boys were arrested. I suspect that the sharing of knowledge and encouragement of developing wisdom is, to some, a threatening prospect. Perhaps they have experienced learning difficulties and are struggling with shame and frustration, or perhaps they disagree strongly with the concept of an intellectually liberated population. Libraries are, after all, a pillar of liberalism.
- wolco 7y agoMore likely just trying to have fun. I'm sure they would do the same to local schools.
- inimino 7y agoThat's sad to hear, I always love coming across the little free libraries. I would guess they were just bored and angry teens, likely not making any deeper statement but just expressing their anger and frustration and willingness to break the rules. Also, it's fun to watch things burn, and they come with built-in kindling. Hopefully some judge will make them rebuild what they burned, that would be fair and give them more appreciation for the work of others that they destroyed thoughtlessly.
- segfaultbuserr 7y ago> or perhaps they disagree strongly with the concept of an intellectually liberated population. Libraries are, after all, a pillar of liberalism. Thoughtful comment. I would agree with you if the attack is somehow organized at 4chan /b/, Kiwi Farms, or some underground IRC for mysterious or unexplained reasons. If it happens, its philosophical implications would be deep. And I won't surprise if it occurs one day. But so far there's no evidence to suggest the attack has any ideological motivation beyond making the attacker famous.
- aaron695 7y ago> Just like trying to set your local public library on fire. No, more like superglueing the doors shut for a few hours. Don't really see the damage, especially since they moved onto Twitch and WOW servers, I'd say more work and a few early nights sleep has got done in the end.
- snazz 7y agoDDoS, I’m assuming? It was intermittently offline yesterday, which was annoying, but I didn’t assume malice then.
- judge2020 7y agoSomeone claimed the attack on twitter with some details (DDoS) - and proved it later by stopping the attack for x minutes then restarting it at a specific time. https://twitter.com/fs0c131y/status/1170093562878472194?s=20 https://twitter.com/fs0c131y/status/1170093562878472194?s=20 - the attacker also went on to DDoS the twitch ingest servers (not twitch.tv itself) knocking some big streamers offline.
- jrochkind1 7y agoDid they say anywhere what their motive was?
- impalallama 7y agoPower tripping most likely.
- comboy 7y agoIt's not cheap, advertising their services seem more likely to me.
- bollockitis 7y agoDo these kinds of attacks usually have a motive?
- ethelward 7y agoThey can be used by blackhats selling e.g. DDoD-netbots to prove the “quality of the merchandise”.
- aldoushuxley001 7y agoI definitely get the feeling that’s what they’re going for. They mentioned they’re just testing out a new botnet made from IoT devices.
- softwaredoug 7y agoJust want to mention, WMF has a very small but elite team of engineers. Amazed they maintain an Alexa top 5 site with many orders of magnitude less engineering staff than Facebook or Reddit. I think they must count ~100 engineers? I can't imagine what such a small team must be going through with a major DDOS - wish them well in their efforts!
- whym 7y ago> I think they must count ~100 engineers? https://wikimediafoundation.org/role/staff-contractors/ https://wikimediafoundation.org/role/staff-contractors/ has the names of 379 employees. I believe (perhaps astonishingly) that is all - engineers and non-engineers combined. Their engineers spread across departments, but judging by the 141 instances of the string 'engineer' in that page, I'd be surprised if the number exceeds 200.
- sprafa 7y agoThat’s what happens I guess when you’re running a charity, you can recruit top talent (I assume many 10x folks wouldn’t mind working for wikimedia!) and every dollar counts. Pretty incredible.
- wolco 7y agoThey seem to be at the leading edge of hiring remotely and they don't pay anywhere near facebook salaries. The culture must be attracting some strong developers.
- kemayo 7y agoSpeaking as someone listed on that page, and having attended all-hands meetings, yeah, we're not huge. Though it is worth bearing in mind that everything's open source, and there's a hefty community component. So there's a more vaguely specified number of people who might provide patches, and individual wikis are mainly run by volunteers.
- 7y ago
- jedieaston 7y agoRemember: there are BitTorrent links that the Wikimedia Foundation gives out of SQL dumps of Wikipedia and the other projects. You can have a copy in case this happens in your country: https://en.wikipedia.org/wiki/Wikipedia:Database_download#Where_do_I_get_it.3F https://en.wikipedia.org/wiki/Wikipedia:Database_download#Wh... Also, the Kiwix project has a hotspot project that allows you to host ZIM files (dumps of Wikipedia and other CC licensed content, like TED talks and StackOverflow) on a Raspberry Pi, allowing you to share it with others. Setup info here: https://www.kiwix.org/en/downloads/kiwix-hotspot/ https://www.kiwix.org/en/downloads/kiwix-hotspot/
- buildbuildbuild 7y agoCaveat: the last full Kiwix English Wikipedia archive was made in 2018. They could use some help with automating their build process if anyone here has the time.
- voltagex_ 7y agoFrom a cursory glance at the site and source code, it's really hard to see who/what is involved with building an archive. There's automated builds set up for the Pi image itself.
- pronoiac 7y agoAgreed. I can see that other Wikipedia languages are crawled - https://wiki.kiwix.org/wiki/Content_in_all_languages https://wiki.kiwix.org/wiki/Content_in_all_languages shows dozens of updates this week - but the best leads I have involve poking around the openZIM Github org, https://github.com/openzim https://github.com/openzim . There might be a running "zimfarm" somewhere?
- bshep 7y agoLooks like you are right, you may be able to join the farm to help ( i have not tested as I am away from my computer at the moment ) https://github.com/openzim/zimfarm/blob/master/worker/README.md https://github.com/openzim/zimfarm/blob/master/worker/README...
- ineedasername 7y agoDoes anyone know the nature of the attack? If specific countries were targeted, or if it was widespread but only crashed some smaller sites with less resources/redundancy?
- o-_o_-o 7y agoI wouldn’t rule out that they could be staging this attack to increase donations.
- Theboda 7y agoApparently this group is behind it. Also attacked WoW and twitch servers.. https://twitter.com/ukdrillas https://twitter.com/ukdrillas
- Nextgrid 7y agoPart of the liability should be shared with the people owning the compromised machines these crazies are using for their attacks, otherwise attacks like these will never stop as long as enough free “ammunition” is being left around by incompetent people who can’t be bothered to secure & monitor their systems properly. Edit: in reply to some of the (valid) counter-arguments, I'd like to say that there are indeed many issues that will need to be considered before passing such a law - this is just an overall idea. In addition, my intent isn't to punish the occasional kid doing something stupid and leaving a misconfigured device, it's to punish companies selling/deploying obviously insecure devices at a large scale, like ISPs deploying cheap shitty outdated network hardware or the countless resellers white-labelling insecure network cameras. Currently there is no penalty for manufacturing insecure hardware and this situation is the consequence of that - I'd like to fix this problem. We have regulations that (mostly successfully) prevent companies from selling hardware that blows up and destroys your house, why can't we have the same for networked hardware?
- deleted 7y ago[deleted]
- Torok 7y agoAward for worst hot take of the day goes to....
- iikoolpp 7y agoI, too, wish to punish people for daring to own something that might have a zero-day.
- Nextgrid 7y agoAre we talking about zero days here or obvious vulnerabilities known for decades but nothing gets done because there’s no cost associated with leaving it insecure? I strongly suspect the latter.
- Semaphor 7y agoHuh, so it wasn’t my network having issues. The weird thing was. That at the same time google.com (though not google.de) stopped working. Weird coincidence?
- xacky 7y agoI'm not surprised. There are a lot of people banned from Wikipedia by their abusive admins looking for revenge.
- ineedasername 7y agoIt might be, but currently doesn't appear that's the motivation here, not if they're also attacking twitch & WoW.
- wolco 7y agoMy guess is they tried google and facebook without any luck so they moved on. The choices made would tell me that they are younger mid-late 20s / probably not from an English speaking country. Motivation.. sense of power.
- aflag 7y agoWhy do you think they are not from an English speaking country? They are likely advertising their botnet (and seems to be working rather well).
- ineedasername 7y agoI think they might think they're not English speaking because it wasn't the English wikipedia sites that went down. Then again, they may easily have tried that too but it's larger, built to handle more traffic.
- klez 7y agoActually the English Wikipedia went down as well, at least here in Italy.
- cybersnowflake 7y agoMaybe the damage will randomly improve the political articles and knock down some of the fiefdoms for a change. Couldn't get much worse...
- jwildeboer 7y agoThat post neither says what they know nor what they’re doing IMHO. I hope there will be a more detailed post Morten soon.
- jwilk 7y agopost-mortem
- lemiffe 7y agoI appreciate them making this statement. I had issues accessing Wikipedia from Turkey a week ago and I assumed censorship, but this week I have also had issues accessing it from Poland and I started suspecting something was amiss.
- sametmax 7y agoI don't understand the goal though. What to gain ? Training for another big target ?
- throwamay1241 7y ago- Advertising for potential DDoS service buyers - Bragging rights - Experimentation Edit: Also potentially political or personal. Eg Posting something that offends 8chan||nation states etc. There's quite often blackmail involved (Pay us $x BTC and we go away). Cloudfront or similar should offer DDoS protection for free as a gesture of goodwill, it's good bragging rights for CF so everyone wins.
- MayeulC 7y ago> Cloudfront or similar should offer DDoS protection for free as a gesture of goodwill, it's good bragging rights for CF so everyone wins. Well, it is still a lot of wasted resources (bandwidth, energy, compute) for everyone involved (ISP, CF, attacker, defender, compromised machines), so I wouldn't be so quick to say that "everyone wins".
- throwamay1241 7y agoConsider it a 'cost of doing business'. Everyone gets DDoSed, I'm pretty sure that's one of CloudFronts primary service-based solutions
- betaby 7y agoWikipedia is behind Cloudflare at that moment.
- deleted 7y ago[deleted]
- krautsourced 7y agoThey already switched to Twitch and WoW. So it seems Wikipedia may just have been the first target cause it is big.
- jacekm 7y agoOn a side note, I was surprised to learn, that Wikipedia does not have a proper status page. status.wikimedia.org redirects to grafana dashboard and it too was down yesterday.
- lukejduncan 7y agoI wouldn’t expect a site to have a publicly available status page or anything like public grafana boards. Isn’t that what HTTP error codes are for? Can you share examples of where this is common?
- detaro 7y agoHTTP status codes tell you that something is broken, but likely not details. Or nothing at all, if all you get is a timeout because the service just got DDoSed. Many services and sites have them, a few random examples: https://status.flickr.net/ https://status.flickr.net/ https://www.vimeostatus.com/ https://www.vimeostatus.com/ https://3down.mit.edu/ https://3down.mit.edu/ https://www.githubstatus.com/ https://www.githubstatus.com/
- roywiggins 7y agoAtlassian has a whole service that just hosts public status pages https://www.statuspage.io/ https://www.statuspage.io/
- Nemo_bis 7y agoIssue tracked at https://phabricator.wikimedia.org/T22079 https://phabricator.wikimedia.org/T22079
- ga-vu 7y agoThese are the clowns, btw: https://twitter.com/UKDrillas/status/1170221000363061250 https://twitter.com/UKDrillas/status/1170221000363061250
- ineedasername 7y agoAnd... they've been booted from twitter.
- ngcc_hk 7y agoRead through it. Any more info who is doing it. Not for accusation but prevention.
- deleted 7y ago[deleted]
- irrational 7y agoAre there non-malicious attacks? Doesn't the word "attack" imply maliciousness?
- joaizn 7y agoIn bug bounty programs you pay security researchers to attack your site so they can find and tell you about potential risks.
- marble-drink 7y ago"Attack" is a technical term and doesn't imply malicious intent. Many attacks are accidental or the result of negligence. Some are performed by researchers in purpose but without malicious intent (e.g. the attacker wants to prove that something is possible without actually doing any damage).