Page MenuHomeMiraheze

Unusual media file in pwiki.arkcls.com
Closed, ResolvedPublic

Description

Wiki: pwiki.arkcls.com

We noticed that a new gzip file appeared in our Media area called Pwikiwiki.xml.gz on 1 April 2019 at 00:00. It appears to have been uploaded by a new user called "Maintenance script". This user was created on 1 March 2019 at 00:00. No one in our team here at ARK CLS is aware of either this user or the file. We suspect that it is malicious in some way. As this is a private wiki I'm surprised that a new user would have sufficient privileges to be able to upload a file.

I've also noticed other unusual users as follows:
"Delete page script"
"GDPRAccount"

I would be very grateful if someone in support team could comment. I would plan to delete the file and block these users.

Best regards

Adrian Bennetton

Event Timeline

John claimed this task.
John subscribed.

pwikiwiki.xml.gz is a backup that you would have requested automatically (T4157). Maintenance script, Delete page script and GDPRAccount are accounts operated by Miraheze.

Hi John

Many thanks I had forgotten that this was the back-up.

Adrian

John triaged this task as Normal priority.Apr 16 2020, 20:48