5 ms·

Inkscape possible domain compromise

154 points by aendruk 3y ago

mholt 3y ago
Looks like a stray index.html was able to slip in there somehow. It pulls a background image from https://new.action247.ag/assets/images/login-background.jpg https://new.action247.ag/assets/images/login-background.jpg Roughly Google-translated from Indonesian, it's a shady gambling scam. It sends your form data to a WhatsApp number, 855717520276. Possibly a hole in Inkscape's CMS (Django)? There's also a fair amount of python code in their website repo, so maybe that, I dunno. From the bottom of their homepage: <a id="dev-stamp" href="https://gitlab.com/inkscape/inkscape-web"><img src="https://media.inkscape.org/static/images/django.svg" title="This site is running: Python 3.6.8 Django 2.2 App: CMS [Home] InkscapeWeb 1.6, as of Mon Aug 21 19:06:31 2023 (5420e21)" alt="PY"/></a> Django 2.2 was last updated over a year ago and has had a number of security patches. An issue should probably be filed on their GitLab: https://gitlab.com/inkscape/inkscape-web/-/issues/ https://gitlab.com/inkscape/inkscape-web/-/issues/
- galbar 3y ago
  Good idea, I just did that: https://gitlab.com/inkscape/inkscape-web/-/issues/647 https://gitlab.com/inkscape/inkscape-web/-/issues/647
  - debugnik 3y ago
    Interesting, so this file was added using the gallery upload function, which accepts arbitrary files. And apparently the official releases are uploaded to the same URL directory? That's just asking for phishing. > Since this issue is closed, I suggest that you add your suggestion as a new issue I mean, I get it, but that sounds nonchalant for such a security issue; I'd expect the maintainer to open it themselves upon reading the problem. Although maybe that explains why the problem exists in the first place.
- tuetuopay 3y ago
  Given the rest of the files are fine, this is the most likely thing that happened. Especially since the file is a download and not a "raw" html file, someone found a way to upload this.
zamadatix 3y ago
HN submission title says (2022) but the discussion seems to be a day old?
- aendruk 3y ago
  Puzzles me too. I didn’t add that.
  - twism 3y ago
    interesting that HN seems to be sourcing the date from the article ...always thought it was a mod that did that
    - ChrisArchitect 3y ago
      Never seen any kind of automation.....mod? But I'm still scratching my head trying to see where in the article it says that
    - phito 3y ago
      The right sidebar timeline-thing says Aug 22. Mod probably saw that and thought it was the year and not the day. US date format bad.
      - ChrisArchitect 3y ago
        Yeah, UI confused me too -- that's today's Date
      - ethbr1 3y ago
        Dates should either be big endian or little endian. I'm American, and I've shifted towards ISO 8601 in communications and documents (e.g. big endian 2023-08-22). The conventional American date ordering is just insane.
        nullindividual 3y ago
        For CFR 21 Part 11 compliance, we use ddMMMyyyy (21AUG2023). Easy to read, no guessing as to what format is in use. For English readers only, but the target audience is the FDA…
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
jan_Sate 3y ago
Could it be just misconfiguration of the server of shared hosting, or just some issues with CDN server? That looks like an unusual URL to compromise.
- thesuitonym 3y ago
  I don't think these gambling scams are targeted attacks. Pretty sure Inkscape just got caught in a spray and pray.
NoMoreNicksLeft 3y ago
[flagged]

154 points by aendruk 3y ago

Looks like a stray index.html was able to slip in there somehow. It pulls a background image from https://new.action247.ag/assets/images/login-background.jpg https://new.action247.ag/assets/images/login-background.jpg Roughly Google-translated from Indonesian, it's a shady gambling scam. It sends your form data to a WhatsApp number, 855717520276. Possibly a hole in Inkscape's CMS (Django)? There's also a fair amount of python code in their website repo, so maybe that, I dunno. From the bottom of their homepage: <a id="dev-stamp" href="https://gitlab.com/inkscape/inkscape-web"><img src="https://media.inkscape.org/static/images/django.svg" title="This site is running: Python 3.6.8 Django 2.2 App: CMS [Home] InkscapeWeb 1.6, as of Mon Aug 21 19:06:31 2023 (5420e21)" alt="PY"/></a> Django 2.2 was last updated over a year ago and has had a number of security patches. An issue should probably be filed on their GitLab: https://gitlab.com/inkscape/inkscape-web/-/issues/ https://gitlab.com/inkscape/inkscape-web/-/issues/

galbar 3y ago
Good idea, I just did that: https://gitlab.com/inkscape/inkscape-web/-/issues/647 https://gitlab.com/inkscape/inkscape-web/-/issues/647
- debugnik 3y ago
  Interesting, so this file was added using the gallery upload function, which accepts arbitrary files. And apparently the official releases are uploaded to the same URL directory? That's just asking for phishing. > Since this issue is closed, I suggest that you add your suggestion as a new issue I mean, I get it, but that sounds nonchalant for such a security issue; I'd expect the maintainer to open it themselves upon reading the problem. Although maybe that explains why the problem exists in the first place.
tuetuopay 3y ago
Given the rest of the files are fine, this is the most likely thing that happened. Especially since the file is a download and not a "raw" html file, someone found a way to upload this.

zamadatix 3y ago

HN submission title says (2022) but the discussion seems to be a day old?

aendruk 3y ago
Puzzles me too. I didn’t add that.
- twism 3y ago
  interesting that HN seems to be sourcing the date from the article ...always thought it was a mod that did that
  - ChrisArchitect 3y ago
    Never seen any kind of automation.....mod? But I'm still scratching my head trying to see where in the article it says that
  - phito 3y ago
    The right sidebar timeline-thing says Aug 22. Mod probably saw that and thought it was the year and not the day. US date format bad.
    - ChrisArchitect 3y ago
      Yeah, UI confused me too -- that's today's Date
    - ethbr1 3y ago
      Dates should either be big endian or little endian. I'm American, and I've shifted towards ISO 8601 in communications and documents (e.g. big endian 2023-08-22). The conventional American date ordering is just insane.
      - nullindividual 3y ago
        For CFR 21 Part 11 compliance, we use ddMMMyyyy (21AUG2023). Easy to read, no guessing as to what format is in use. For English readers only, but the target audience is the FDA…

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

jan_Sate 3y ago

Could it be just misconfiguration of the server of shared hosting, or just some issues with CDN server? That looks like an unusual URL to compromise.

thesuitonym 3y ago
I don't think these gambling scams are targeted attacks. Pretty sure Inkscape just got caught in a spray and pray.

NoMoreNicksLeft 3y ago

[flagged]