Inkscape possible domain compromise | Hacker News Reader

Inkscape possible domain compromise

discourse.nixos.org

154 pointsaendruk16 comments

Looks like a stray index.html was able to slip in there somehow.

It pulls a background image from https://new.action247.ag/assets/images/login-background.jpg

Roughly Google-translated from Indonesian, it's a shady gambling scam. It sends your form data to a WhatsApp number, 855717520276.

Possibly a hole in Inkscape's CMS (Django)? There's also a fair amount of python code in their website repo, so maybe that, I dunno. From the bottom of their homepage:

    <a id="dev-stamp" href="https://gitlab.com/inkscape/inkscape-web"><img src="https://media.inkscape.org/static/images/django.svg" title="This site is running:
    Python 3.6.8
    Django 2.2
    App: CMS [Home]
    InkscapeWeb 1.6, as of Mon Aug 21 19:06:31 2023 (5420e21)" alt="PY"/></a>

Django 2.2 was last updated over a year ago and has had a number of security patches.

An issue should probably be filed on their GitLab: https://gitlab.com/inkscape/inkscape-web/-/issues/

Good idea, I just did that: https://gitlab.com/inkscape/inkscape-web/-/issues/647

Interesting, so this file was added using the gallery upload function, which accepts arbitrary files.

And apparently the official releases are uploaded to the same URL directory? That's just asking for phishing.

> Since this issue is closed, I suggest that you add your suggestion as a new issue

I mean, I get it, but that sounds nonchalant for such a security issue; I'd expect the maintainer to open it themselves upon reading the problem. Although maybe that explains why the problem exists in the first place.

Given the rest of the files are fine, this is the most likely thing that happened. Especially since the file is a download and not a "raw" html file, someone found a way to upload this.

Could it be just misconfiguration of the server of shared hosting, or just some issues with CDN server? That looks like an unusual URL to compromise.

I don't think these gambling scams are targeted attacks. Pretty sure Inkscape just got caught in a spray and pray.

HN submission title says (2022) but the discussion seems to be a day old?

Puzzles me too. I didn’t add that.

interesting that HN seems to be sourcing the date from the article ...always thought it was a mod that did that

Never seen any kind of automation.....mod?

But I'm still scratching my head trying to see where in the article it says that

The right sidebar timeline-thing says Aug 22. Mod probably saw that and thought it was the year and not the day.

US date format bad.

Yeah, UI confused me too -- that's today's Date

Dates should either be big endian or little endian.

I'm American, and I've shifted towards ISO 8601 in communications and documents (e.g. big endian 2023-08-22).

The conventional American date ordering is just insane.

For CFR 21 Part 11 compliance, we use ddMMMyyyy (21AUG2023). Easy to read, no guessing as to what format is in use. For English readers only, but the target audience is the FDA…

I find this good if it's really critical to avoid any ambiguity... but I have to admit I still prefer the ISO format because it sorts lexicographically. (But this is mostly for untyped stuff like file names, etc.)

Yep, this is current. Last post was 5 min. ago. @dang or other mod should remove the date from the title.

Reply on news.ycombinator.com