Wikipedia:Compromised accounts
 | This is an information page. It is not one of Wikipedia's policies or guidelines; rather, its purpose is to explain certain aspects of Wikipedia's norms, customs, technicalities, or practices. It may reflect differing levels of consensus and vetting. |
Accounts on Wikipedia may be compromised (hacked) in a number of ways, allowing the misuse of user access levels, as well as user reputation for illegitimate purposes. It is important for users to take active steps to protect their accounts, especially those with high levels of access such as administrators. This may be done in a number of ways.
Users whose accounts are compromised may have access reduced or their accounts blocked or globally locked.
Why accounts become compromised[edit]
Both weak and strong passwords are vulnerable, although strong passwords are better. Although this is written with Wikipedia in mind, most of this is applicable to other website accounts.
Weak passwords[edit]
Weak passwords are especially vulnerable. Weak passwords are also vulnerable to techniques used on strong passwords.
- Brute-force attacks
- Infiltrators try numerous passwords, often in an automated fashion, until they happen across the correct password. Although on Wikipedia there are limitations regarding the number of login attempts over a given time period, users are still vulnerable if they use weak passwords, especially commonly used passwords. Countermeasures are a maximum of 5 logins every 5 minutes, with no more than 150 attempts allowed every 48 hours. A record is also kept of every failed login attempt.
- Hacked website with stolen details
- There is little the user can do about data breaches from websites. Although strong passwords may also be vulnerable if this happens, weak passwords are much more easily decrypted if the website uses encryption to encrypt its password database.
Strong and weak passwords[edit]
Even strong passwords can easily become vulnerable. But they are much better than weak passwords, principally as they discourage brute-force attacks, and they make hacked websites much less vulnerable to password theft.
- Password sharing for multiple uses
- Passwords are highly vulnerable if re-used on different sites. If one website is hacked, and the password hash is broken, or the passwords were not stored securely, all the other sites with the same password are vulnerable. The same goes for other forms of password breaches.
- Similar passwords for multiple uses
- If similar passwords are used on multiple websites, the hacker may be able to guess the correct password for a different use, however strong the password is. This may include a brute-force method.
- Insecure email - password resetting etc.
- Many services, including Wikipedia, allow users to reset a forgotten password by requesting a reset link be sent to their registered email address. If your email account is somehow compromised, an attacker can use it to gain control of other accounts you have. You should therefore secure your email account that receives reset links at least as well as any passwords that might need resetting. Gmail and Fastmail (and probably others) support two-factor authentication (2FA) and you should probably use it if you receive sensitive email or password resets. If 2FA is too inconvenient for everyday email, you might set up a separate 2FA-protected mailbox just for reset links and other sensitive material.
- Insecure computers and devices - keystroke logging, cookie hijacking etc.
- Logging in on insecure computers or devices, especially those for public use, can lead to passwords being stolen. The password is copied when it is entered to log on to a website by a malicious program called a keylogger, or an HTTP cookie allowing account access is stolen from a vulnerable computer's browser. If passwords are stored electronically, it may be possible to hack them if the device or program used is insecure.
- Insecure networks - packet sniffing etc.
- Insecure networks are generally secure from password theft, as long as HTTPS is used by the website. Wikipedia uses HTTPS for connections. But passwords transferred in an unencrypted manner are vulnerable, and rogue networks may infiltrate a computer with lax security. Cloud storage of passwords may be a vulnerability if they are not encrypted properly.
- Inadvertent or unwise password sharing
- This may be from following a link from a fake email, to direct you to a fake website in a so-called phishing attack. Sharing your password with someone dubious could happen in many ways. The sharing party may not necessarily be the end-user; password sharing may happen with the website provider.
- Social engineering
- Phishing is not the only risk, attackers can trick you into running malicious code in the browser, sending browser cookies to the attacker or doing something dangerous without you knowing it. To stay protected, never ever follow the instructions of the attacker; that means you shouldn't run unknown code or send any browser data like cookies.
- Other password stealing
- Even physically stored passwords are vulnerable to theft and copying.
Thus, even strong passwords can be rendered useless unless properly secured.
Counter-measures[edit]
There are a variety of measures that can decrease the likelihood of an account becoming compromised.
Two-factor authentication (2FA)[edit]
- Two-factor authentication (2FA)
- This is a very effective and relatively simple measure. Now available to holders of advanced permissions, with work under way to expand availability to other users in the future. Very useful as it provides a different password each time to thwart key-loggers and other password compromises, and requires access to particular device(s).
- Bot passwords
- Useful for using programs like AutoWikiBrowser with 2FA enabled. See mw:Manual:Huggle/Bot passwords and Wikipedia:Using AWB with 2FA for information on this.
Other security practices[edit]
Other measures, especially pertinent if not using 2FA.
- Strong passwords
- An important but not invulnerable technique. Recommended for all, but a requirement for holders of advanced permissions.
- Committed identity
- Very useful in proving a compromised account has been returned to a legitimate owner.
- Completely different strong passwords for all websites
- Password sharing greatly increases vulnerability, even with strong passwords. Using similar passwords can also be a risk. Password managers are invaluable for storing collections of complex passwords instead of needing to remember them.
- Using a different account for public or insecure computers
- This is especially relevant if the user holds advanced permissions.
- Periodic password changing
- A compromised password may not be immediately used; periodically changing it can prevent previously compromised, but not yet exploited passwords from being used. Change it at Special:ChangeCredentials
- High computer, device and network security
- Computers and other devices used to logon to Wikipedia should be kept secure, especially through the use of anti-virus programs and firewalls. Only trusted software should be downloaded and installed. Computers in shared spaces should be locked before being left. Configure modem/router firewall features correctly.
- High password security
- Never share passwords, even with staff members. No one else should ever need to know them. Store passwords securely, and change them if there is any chance they have become compromised.
None of these techniques are foolproof, but a combination them can greatly reduce the chance of a compromised account.
Email account security[edit]
- Using these measures with your email account
- As described above, access to your email account may allow access to websites that use email based password resetting.
Login notifications[edit]
Through the Wikipedia:Notifications system, you will be alerted when someone attempts and fails to log in to your account. Multiple alerts are bundled into one for attempt from a new device/IP. For a known device/IP, you get one alert for every 5 attempts. If you suspect that someone else has tried to access your account, you may want to change your password anyway even if you do have a strong password.
Alerts notifying you of a successful login from a new device/IP are only available by email. Web notifications for successful logins from a new device/IP are currently disabled.
By default, the "failed login attempts" and "login from an unfamiliar device" notifications are on for everyone. This is configurable in the notifications preferences.
After being compromised[edit]
Suspected compromised accounts[edit]
If you are reasonably certain that an account may be compromised, please contact:
- Stewards, who can lock the account to prevent the password/email from being changed, as well as stopping any immediate abuse. Contact at m:Steward requests/Global to request or appeal a global lock. You can also contact stewards in the following ways:
- To gain emergency assistance or to ask a question, join the IRC channel #wikimedia-stewards connect and write !steward (your message here) in this channel to notify stewards of an emergency.
- To contact a steward directly, use that steward's talk page.
- Requests can also be sent to the steward WP:OTRS queue through the interface at m:Special:Contact/Stewards, or by emailing stewards
wikimedia.org
- WMF's Trust and Safety team can investigate further, by using CheckUser tools or contacting system administrators to check the account's login history. Contact via email at cawikimedia.org
- Checkusers can confirm if a different IP is being used to access the account. To contact see Contacting a checkuser.
- Administrators, who can block the account if it is taking disruptive actions. Please note that in such cases, a global lock is preferred, since it stops disruption to all projects where the account is active and preserves the user information. They can be contacted at Wikipedia:Administrators' noticeboard.
Each group will end up contacting others during the process, either for confirmation or to perform local actions after the emergency has subsided. Advanced permissions may be removed for this portion of the case, if it is suspected that the agent(s) responsible for compromising the account are still trying to access it.
Regaining account access[edit]
A typical result of having your account compromised is having the account either blocked or locked (a lock disables login from all Wikimedia projects) to prevent further disruption. Although administrators on Wikipedia may be able to help, the WMF Trust and Safety team may also be contacted. See above for details.
- No access to your account
- If you are shut out from your account from a password change, a password reset may help you gain access again. But if the email has been changed this will not be possible. Logs of email changes are kept for admin accounts, which may help in establishing account ownership.
- Your account is blocked
- This is a likely consequence of an account being compromised. As it may not be possible to prove that an account has been returned you may have to start afresh. Having a committed identity is one of the few ways that you can prove that you are the user in question, but without this it may be very difficult to prove accounts have been returned to their rightful owner.
- Your extra access may be removed
- Special user groups may be temporarily removed from your account until you are back in control of it.
- Your account has been globally locked
- Please contact Wikimedia Foundation's Trust and Safety team by emailing cawikimedia.org.