Diablo wiki used for spreading malware?

Viruses and worms
1

Sucuri reports that community wiki for Diablo game series has been used for spreading malware. However, this seems to be only with IE browsers, if what Sucuri Malware Labs says is correct.

https://sitecheck.sucuri.net/results/diablo.wikia.com/wiki/diablo_wiki

2

Hi Pernaman,

Thanks for the heads-up on this and also for the reporting, let us dive into this detection a little further :wink: …

The leak of Mediawiki leaking MediaWiki version: MediaWiki 1.19.24 was being reported April 9th last.

  • MediaWiki user Bawolff pointed out that the SVG filter to prevent

injecting JavaScript using animate elements was incorrect.
https://phabricator.wikimedia.org/T86711
For particulars read here: http://www.openwall.com/lists/oss-security/2015/04/07/3

See where this scan is going: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fdiablo.wikia.com%2F__load%2F-%2Fcb%253D1444834036%2526debug%253Dfalse%2526lang%253Den%2526newve%253D1%2526only%253Dscripts%2526skin%253Doasis%2Fstartup

And your assumption for IE browsers seems right - in the code I see

var isCompatible=function(){if(navigator.appVersion.indexOf('MSIE')!
  • particularly to detect IE version prior to IE9 with JavaScript.

Via debug we get this important attack info:

 mw.loader.state({"/__load/-/cb=1444834036\x26debug=false\x26lang=en\x26only=scripts\x26reviewed=1441719857\x26ski":"missing"});  /* cache key: diablo:resourceloader:filter:minify-js:7:9db0990a97c79afdb2438db0a66f4d74 */

old parser may still be used here → https://developers.google.com/speed/pagespeed/module/filter-js-minify
with the use of known x3c script malware there is a malcode threat.

The leakage should be patched a.s.a.p. Be also aware on PlayWorld - see this link inside the code : http://archive.is/slot1.images3.wikia.nocookie.net for the request path (unrecognized!)-> Jetty(9.3.z-SNAPSHOT) Web Server has new /ui patch broken in HA mode! There are some oos-security issues to be settled here!

Just a few snippets on the malcode that Sucuri’s is reporting. Be aware and stay secure,

polonus (volunteer website security analyst and website error-hunter)

3

Cannot access due “451 Unavailable - This content is not available in your country.” but I get the picture.

I guess someone should report this to someone on Mediawiki? It feels pretty bad that these kinds of things happen in the site that is used every day by great part of internet community :-\

4

You are welcome, and can report it to them, refering to the link for this thread.
Hope they clean up their slate soon,

polonus

5

I’ve reported the issue to Wikia staff via e-mail. I also included link to this topic just in case.

6

I got respond from Wikia support:

Hello,

Thanks for contacting Wikia.

After reviewing the script for ourselves, we feel as though this alert was in error. There is no evidence that the script in question could be used in the way described in that thread based on our testing. However, since the script in question was not being actively utilized, we’ve gone ahead and removed it just as a precaution. We appreciate you bringing it to our attention.

Sucuri shows site being clean again :slight_smile:

https://sitecheck.sucuri.net/results/diablo.wikia.com/wiki/diablo_wiki