You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@infra.apache.org by "Matt Foley (Created) (JIRA)" <ji...@apache.org> on 2011/12/22 10:04:31 UTC
[jira] [Created] (INFRA-4244) prevent spam exploit at
http://wiki.apache.org/hadoop/
prevent spam exploit at http://wiki.apache.org/hadoop/<user_name>
-----------------------------------------------------------------
Key: INFRA-4244
URL: https://issues.apache.org/jira/browse/INFRA-4244
Project: Infrastructure
Issue Type: Improvement
Security Level: public (Regular issues)
Reporter: Matt Foley
Some robot just spammed the wiki by creating fake home pages for users who didn't previously have them. The changes were made in the name of a wiki user "jingshen". This user created a spammy home page for itself at http://wiki.apache.org/hadoop/jingshen on 2011-12-20 08:18:34.
I was one of the victims at http://wiki.apache.org/hadoop/MattFoley
I've deleted the bad page, but presumably it's available in the CMS.
Other created pages which I did not delete were:
* AmreshSingh
* Ivan de Prado
* alevchuk
* jiuzheyang
* RavindraRawat
* JohnDorion
However, there was one user with a pre-existing real home page, who had spam added to his home page by jingshen:
* PetruDimulescu
I only subscribe to Hadoop wiki. It's likely the spammer did the same to other parts of the wiki. I suspect the spammer harvested wiki usernames from the emails about recently changed pages.
I see the anti-spam subsystem has updated the BadContent page to know the spammer's link.
Maybe nothing further can be done, I'm not an expert on wiki anti-spam.
This info is being captured and shared in case there is any way to decrease vulnerability to this noise. Thanks.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (INFRA-4244) prevent spam exploit at
http://wiki.apache.org/hadoop/
Posted by "Gavin (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/INFRA-4244?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13174757#comment-13174757 ]
Gavin commented on INFRA-4244:
------------------------------
I have disabled the spammer(s) and reverted all the damage they did.
I have also enabled wiki protection so onlty those in your AdminGroup and ContributorsGroup can edit pages from now on,.
Someone please check both of those groups for anyone that should not be there - the ContributorsGroup looks particularly long and contains folks without a wiki account and lots of others that seemingly have never edited the wiki apart from to add their name to the list. If someone doesnt cull that list soon I'll do it myself based on who has edited the wiki in the past.
In the meantime, enjoy your new spam free wiki!
> prevent spam exploit at http://wiki.apache.org/hadoop/<user_name>
> -----------------------------------------------------------------
>
> Key: INFRA-4244
> URL: https://issues.apache.org/jira/browse/INFRA-4244
> Project: Infrastructure
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Reporter: Matt Foley
> Assignee: Gavin
>
> Some robot just spammed the wiki by creating fake home pages for users who didn't previously have them. The changes were made in the name of a wiki user "jingshen". This user created a spammy home page for itself at http://wiki.apache.org/hadoop/jingshen on 2011-12-20 08:18:34.
> I was one of the victims at http://wiki.apache.org/hadoop/MattFoley
> I've deleted the bad page, but presumably it's available in the CMS.
> Other created pages which I did not delete were:
> * AmreshSingh
> * Ivan de Prado
> * alevchuk
> * jiuzheyang
> * RavindraRawat
> * JohnDorion
> However, there was one user with a pre-existing real home page, who had spam added to his home page by jingshen:
> * PetruDimulescu
> I only subscribe to Hadoop wiki. It's likely the spammer did the same to other parts of the wiki. I suspect the spammer harvested wiki usernames from the emails about recently changed pages.
> I see the anti-spam subsystem has updated the BadContent page to know the spammer's link.
> Maybe nothing further can be done, I'm not an expert on wiki anti-spam.
> This info is being captured and shared in case there is any way to decrease vulnerability to this noise. Thanks.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Closed] (INFRA-4244) prevent spam exploit at
http://wiki.apache.org/hadoop/
Posted by "Gavin (Closed) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/INFRA-4244?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Gavin closed INFRA-4244.
------------------------
Resolution: Fixed
Assignee: (was: Gavin)
Done.
> prevent spam exploit at http://wiki.apache.org/hadoop/<user_name>
> -----------------------------------------------------------------
>
> Key: INFRA-4244
> URL: https://issues.apache.org/jira/browse/INFRA-4244
> Project: Infrastructure
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Reporter: Matt Foley
>
> Some robot just spammed the wiki by creating fake home pages for users who didn't previously have them. The changes were made in the name of a wiki user "jingshen". This user created a spammy home page for itself at http://wiki.apache.org/hadoop/jingshen on 2011-12-20 08:18:34.
> I was one of the victims at http://wiki.apache.org/hadoop/MattFoley
> I've deleted the bad page, but presumably it's available in the CMS.
> Other created pages which I did not delete were:
> * AmreshSingh
> * Ivan de Prado
> * alevchuk
> * jiuzheyang
> * RavindraRawat
> * JohnDorion
> However, there was one user with a pre-existing real home page, who had spam added to his home page by jingshen:
> * PetruDimulescu
> I only subscribe to Hadoop wiki. It's likely the spammer did the same to other parts of the wiki. I suspect the spammer harvested wiki usernames from the emails about recently changed pages.
> I see the anti-spam subsystem has updated the BadContent page to know the spammer's link.
> Maybe nothing further can be done, I'm not an expert on wiki anti-spam.
> This info is being captured and shared in case there is any way to decrease vulnerability to this noise. Thanks.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Assigned] (INFRA-4244) prevent spam exploit at
http://wiki.apache.org/hadoop/
Posted by "Gavin (Assigned) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/INFRA-4244?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Gavin reassigned INFRA-4244:
----------------------------
Assignee: Gavin
> prevent spam exploit at http://wiki.apache.org/hadoop/<user_name>
> -----------------------------------------------------------------
>
> Key: INFRA-4244
> URL: https://issues.apache.org/jira/browse/INFRA-4244
> Project: Infrastructure
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Reporter: Matt Foley
> Assignee: Gavin
>
> Some robot just spammed the wiki by creating fake home pages for users who didn't previously have them. The changes were made in the name of a wiki user "jingshen". This user created a spammy home page for itself at http://wiki.apache.org/hadoop/jingshen on 2011-12-20 08:18:34.
> I was one of the victims at http://wiki.apache.org/hadoop/MattFoley
> I've deleted the bad page, but presumably it's available in the CMS.
> Other created pages which I did not delete were:
> * AmreshSingh
> * Ivan de Prado
> * alevchuk
> * jiuzheyang
> * RavindraRawat
> * JohnDorion
> However, there was one user with a pre-existing real home page, who had spam added to his home page by jingshen:
> * PetruDimulescu
> I only subscribe to Hadoop wiki. It's likely the spammer did the same to other parts of the wiki. I suspect the spammer harvested wiki usernames from the emails about recently changed pages.
> I see the anti-spam subsystem has updated the BadContent page to know the spammer's link.
> Maybe nothing further can be done, I'm not an expert on wiki anti-spam.
> This info is being captured and shared in case there is any way to decrease vulnerability to this noise. Thanks.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (INFRA-4244) prevent spam exploit at
http://wiki.apache.org/hadoop/
Posted by "#asfinfra IRC Bot (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/INFRA-4244?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13174705#comment-13174705 ]
#asfinfra IRC Bot commented on INFRA-4244:
------------------------------------------
<danielsh> secondary things first, the CMS is _completely_ separate from (and younger than) the moin wiki.
> prevent spam exploit at http://wiki.apache.org/hadoop/<user_name>
> -----------------------------------------------------------------
>
> Key: INFRA-4244
> URL: https://issues.apache.org/jira/browse/INFRA-4244
> Project: Infrastructure
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Reporter: Matt Foley
>
> Some robot just spammed the wiki by creating fake home pages for users who didn't previously have them. The changes were made in the name of a wiki user "jingshen". This user created a spammy home page for itself at http://wiki.apache.org/hadoop/jingshen on 2011-12-20 08:18:34.
> I was one of the victims at http://wiki.apache.org/hadoop/MattFoley
> I've deleted the bad page, but presumably it's available in the CMS.
> Other created pages which I did not delete were:
> * AmreshSingh
> * Ivan de Prado
> * alevchuk
> * jiuzheyang
> * RavindraRawat
> * JohnDorion
> However, there was one user with a pre-existing real home page, who had spam added to his home page by jingshen:
> * PetruDimulescu
> I only subscribe to Hadoop wiki. It's likely the spammer did the same to other parts of the wiki. I suspect the spammer harvested wiki usernames from the emails about recently changed pages.
> I see the anti-spam subsystem has updated the BadContent page to know the spammer's link.
> Maybe nothing further can be done, I'm not an expert on wiki anti-spam.
> This info is being captured and shared in case there is any way to decrease vulnerability to this noise. Thanks.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (INFRA-4244) prevent spam exploit at
http://wiki.apache.org/hadoop/
Posted by "#asfinfra IRC Bot (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/INFRA-4244?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13174707#comment-13174707 ]
#asfinfra IRC Bot commented on INFRA-4244:
------------------------------------------
<danielsh> see http://wiki.apache.org/general/OurWikiFarm#per_wiki_access_control_-_tighten_your_wiki_just_a_little.2C_benefit_just_a_lot
> prevent spam exploit at http://wiki.apache.org/hadoop/<user_name>
> -----------------------------------------------------------------
>
> Key: INFRA-4244
> URL: https://issues.apache.org/jira/browse/INFRA-4244
> Project: Infrastructure
> Issue Type: Improvement
> Security Level: public(Regular issues)
> Reporter: Matt Foley
>
> Some robot just spammed the wiki by creating fake home pages for users who didn't previously have them. The changes were made in the name of a wiki user "jingshen". This user created a spammy home page for itself at http://wiki.apache.org/hadoop/jingshen on 2011-12-20 08:18:34.
> I was one of the victims at http://wiki.apache.org/hadoop/MattFoley
> I've deleted the bad page, but presumably it's available in the CMS.
> Other created pages which I did not delete were:
> * AmreshSingh
> * Ivan de Prado
> * alevchuk
> * jiuzheyang
> * RavindraRawat
> * JohnDorion
> However, there was one user with a pre-existing real home page, who had spam added to his home page by jingshen:
> * PetruDimulescu
> I only subscribe to Hadoop wiki. It's likely the spammer did the same to other parts of the wiki. I suspect the spammer harvested wiki usernames from the emails about recently changed pages.
> I see the anti-spam subsystem has updated the BadContent page to know the spammer's link.
> Maybe nothing further can be done, I'm not an expert on wiki anti-spam.
> This info is being captured and shared in case there is any way to decrease vulnerability to this noise. Thanks.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira