5 ms·

Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js

Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page to delete 3 random articles from the global namespace, AND use the Special:Random with action=delete to delete another 20 random articles EDIT! The Special:Nuke is really weird. It gets a default list of articles to nuke from the search field, which could be any group of articles, and rubber-stamps nuking them. It does this three times in a row.

divbzero 7mo ago
There doesn’t seem to be an ulterior motive beyond “Muahaha, see the trouble I can cause!”
- batiudrami 7mo ago
  A classical virus, from the good old days. None of this botnet/bitcoin mining in the background nonsense.
  - mghackerlady 7mo ago
    I've always wanted to make a virus like those of the olden days. I wouldn't do anything malicious with it, but maybe I would deploy it to a friends computer if it wasn't very destructive. What resources are there to learn about viruses?
  - aerique 7mo ago
    On the Atari ST we had a boot sector virus that inverted the mouse Y-axis after some random time. So annoying.
- creatonez 7mo ago
  No one actually knows what the payload from basemetrika.ru contains, though. So it's possible it was originally intended to be more damaging. But no matter what it would have caught attention super fast, so there's probably an upper limit to how sophisticated it could have been.
256_ 7mo ago
As someone on the Wikipediocracy forums pointed out, basemetrika.ru does not exist. I get an NXDomain response trying to resolve it. The plot thickens.
- pKropotkin 7mo ago
  Yeah, basemetrika.ru is free now. Should we occupy it? ;)
  - 256_ 7mo ago
    I'm half-tempted to try and claim it myself for fun and profit, but I think I'll leave it for someone else. What should we put there, anyway?
    - gchamonlive 7mo ago
      I'd log requests and echo them back in the page
    - gibsonsmog 7mo ago
      Go old school and have the script inject the "how did this get here im not good with computers" cat onto random pages
    - speedgoose 7mo ago
      A JavaScript call to window.alert to pause the JavaScript VM.
      - Imustaskforhelp 7mo ago
        Looks like someone other from the hackernews community has bought the domain https://news.ycombinator.com/item?id=47263323#47265499 https://news.ycombinator.com/item?id=47263323#47265499
    - yreg 7mo ago
      The antinuke
dheera 7mo ago
Wouldn't be surprised if elaborate worms like this are AI-designed
- nhubbard 7mo ago
  I wouldn't be surprised either. But the original formatting of the worm makes me think it was human written, or maybe AI assisted, but not 100% AI. It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output.
  - creatonez 7mo ago
    > It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output. Indeed. One of those unusual choices is that it uses jQuery. Gotta have IE6 compatibility in your worm! I'm not sure what to make of `Number("20")` in the source code. I would think it's some way to get around some filter intended to discourage CPU-intensive looping, but I don't think user scripts have any form of automated moderation, and if that were the case it doesn't make sense that they would allow a `for` loop in the first place.
    - dheera 7mo ago
      jQuery is still sooo much easier to use than React and whatever other messes modern frameworks have created. As a bonus, you don't have to npm build your JS project, you just double click and it opens and works without any build step, which is how interpreted languages were intended to be.
- integralid 7mo ago
  I would. AI designed software in general does not include novel ideas. And this is the kind of novel software AI is not great at, because there's not much training data. Of course it's very possible someone wrote it with AI help. But almost no chance it was designed by AI.
  - bawolff 7mo ago
bawolff 7mo ago
> Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru Note while this looks like its trying to trigger an xss, what its doing is ineffective, so basemetrika.ru would never get loaded (even ignoring that the domain doesnt exist)

divbzero 7mo ago

There doesn’t seem to be an ulterior motive beyond “Muahaha, see the trouble I can cause!”

batiudrami 7mo ago
A classical virus, from the good old days. None of this botnet/bitcoin mining in the background nonsense.
- mghackerlady 7mo ago
  I've always wanted to make a virus like those of the olden days. I wouldn't do anything malicious with it, but maybe I would deploy it to a friends computer if it wasn't very destructive. What resources are there to learn about viruses?
- aerique 7mo ago
  On the Atari ST we had a boot sector virus that inverted the mouse Y-axis after some random time. So annoying.
creatonez 7mo ago
No one actually knows what the payload from basemetrika.ru contains, though. So it's possible it was originally intended to be more damaging. But no matter what it would have caught attention super fast, so there's probably an upper limit to how sophisticated it could have been.

256_ 7mo ago

As someone on the Wikipediocracy forums pointed out, basemetrika.ru does not exist. I get an NXDomain response trying to resolve it. The plot thickens.

pKropotkin 7mo ago
Yeah, basemetrika.ru is free now. Should we occupy it? ;)
- 256_ 7mo ago
  I'm half-tempted to try and claim it myself for fun and profit, but I think I'll leave it for someone else. What should we put there, anyway?
  - gchamonlive 7mo ago
    I'd log requests and echo them back in the page
  - gibsonsmog 7mo ago
    Go old school and have the script inject the "how did this get here im not good with computers" cat onto random pages
  - speedgoose 7mo ago
    A JavaScript call to window.alert to pause the JavaScript VM.
    - Imustaskforhelp 7mo ago
      Looks like someone other from the hackernews community has bought the domain https://news.ycombinator.com/item?id=47263323#47265499 https://news.ycombinator.com/item?id=47263323#47265499
  - yreg 7mo ago
    The antinuke

dheera 7mo ago

Wouldn't be surprised if elaborate worms like this are AI-designed

nhubbard 7mo ago
I wouldn't be surprised either. But the original formatting of the worm makes me think it was human written, or maybe AI assisted, but not 100% AI. It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output.
- creatonez 7mo ago
  > It has a lot of unusual stylistic choices that I don't believe an AI would intentionally output. Indeed. One of those unusual choices is that it uses jQuery. Gotta have IE6 compatibility in your worm! I'm not sure what to make of `Number("20")` in the source code. I would think it's some way to get around some filter intended to discourage CPU-intensive looping, but I don't think user scripts have any form of automated moderation, and if that were the case it doesn't make sense that they would allow a `for` loop in the first place.
  - dheera 7mo ago
    jQuery is still sooo much easier to use than React and whatever other messes modern frameworks have created. As a bonus, you don't have to npm build your JS project, you just double click and it opens and works without any build step, which is how interpreted languages were intended to be.
integralid 7mo ago
I would. AI designed software in general does not include novel ideas. And this is the kind of novel software AI is not great at, because there's not much training data. Of course it's very possible someone wrote it with AI help. But almost no chance it was designed by AI.
- bawolff 7mo ago

bawolff 7mo ago

> Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru Note while this looks like its trying to trigger an xss, what its doing is ineffective, so basemetrika.ru would never get loaded (even ignoring that the domain doesnt exist)