Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

Question

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then opened Firebug and inspected the box and saw that it was actually part of the webpage itself and that clicking its confirmation button would take me somewhere I didn't want to go. It was very cleverly disguised to look real.

I've never before seen anything like this. Is this the only case or has this been known to happen? I've provided a screenshot to show what it looked like:

Answer 1

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program.

There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting.

To test this theory you could log into your account and opt-out of parental controls. I wouldn't advice doing it from any link presented in the pop-up in case it is malicious though.

Once you've done that try accessing the same page to see if the issue re-occurs.

Another way to test it would be to access the site over HTTPS as then they shouldn't be able to inject any content unless they've installed a trusted root certificate in your browser, for which you would have needed to install BT software on the affected system.

As to your original questions about criminals injecting content into legitimate websites, this is a common vector of attack, either via compromise of the website (e.g. through exploitation of outdated software) or via content injected into the site such as adverts (this is common enough to have its own Wikipedia definition "malvertising")

As to whether it could happen to Wikipedia, I'm not aware of that occuring and with Wikipedia being such a well trafficked site, I'd expect it to be a large target.

Answer 2

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum.

Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from the upvote button into the post (so that everyone opening the post would automatically upvote it) and posted a Black Overlord picture on the main page. The following day the blog was fixed with improved post sanitizing, but hundreds of people have executed the malicious JavaScript code before that happened. Replace the upvote code with an XSS script which steals passwords, and you will see how dangerous it could have been.

If you're forced to use an HTTP proxy to access the web, your provider or employer may inject scripts in about any page. These are usually not malicious, but it can be quite annoying. Also, if your provider gets hacked, you may be exposed to whatever scripts the hackers put in place.

Answer 3

I've never before seen anything like this. Is this the only case or has this been known to happen?

The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario.

There is one interesting scenario about your question: as @RоryMcCune said, what you witnessed is quite frequent, so an attacker could impersonate that pop-up. I mean, an attacker who succeed to compromise a given website can craft a pop-up similar to that one since it is widespread and trusted.

This impersonation can be used to perform two purposes:

1. Clickjacking attacks
2. Drive-by download attacks

The worst aspect of this negative scenario is that drive-by download attacks consist in downloading without your consent a malware (even if spywares and malwares are more used with this method) on your machine/phone. There are two ways this could be triggered: without any interaction, I mean by just visiting a a website, or by requiring the user's interaction via, for instance, clicking to confirm, cancel or exit a pop-up message (as in your case). These attacks exploit vulnerabilities of browsers you use or their plugins.

Did drive-by download attacks happen on some famous websites as you asked? Yes. Let me mention one good example: on 2011, an attack exploited the Java browser plugin to infect thousands of victims who visited Amnesty International's homepage in UK.

Your scenario could also be a clickjacking attack in which the victim is tricked to click on some online content that is intended either for advertisement or, in worst case, to steal sensible/private information from you or even compromise your machine using the drive-by download attack as a complement method. Such attacks target social networks such as Facebook, Twitter (and this is frequent).

Answer 4

A mature wiki software like Wikimedia usually does not allow normal users to embed any scripts in wiki articles.

But still, wikis are prime targets for search engine spammers. The structure of wikis is very search-engine friendly which means that wikis often get quite a lot of page rank which in turn exends to any websites linked from them. Also, anything posted to them will live forever in the edit history of the page, even when reverted... if it even gets reverted - there are countless dead wikis on the web which were created, got filled with lots of useful and relevant content, were linked by all kinds of 3rd party websites, got indexed by search engines and were then forgotten by users and admins but never taken offline. Such wikis make great link farms.

As a result any wiki with just a bit of exposure will soon be haunted by bots which post spam to the wiki, either in form of new articles or in form of adding irrelevant links to existing articles.

People who have no ethical problems with using this form of destructive black-hat SEO often have no qualms about spreading malware either, so the websites they try to promote can often be unsafe to visit.

Bottom line: Browsing a spambot-infested wiki is usually safe (though not necessarily useful), but blindly following any offsite links from a wiki is not.