Template talk:Hacking in the 2010s
Latest comment: 2 years ago by 205.175.106.199 in topic Bvp47
 | This template does not require a rating on Wikipedia's content assessment scale. It is of interest to the following WikiProjects: | ||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||
Hackers only?
editWould Stuxnet would fit in here or is the intention to have the template solely focus on hackers and hacker groups? Gobonobo T C 08:10, 21 December 2011 (UTC)
- I guess you could add a group named 'worms', 'malware' or something along the lines of that. SalfEnergy 22:03, 28 December 2011 (UTC)
GNAA
editI would like for this template to use GNAA instead of its expletive full naming, I am currently in an edit war with another user regarding this Camilo Sánchez Talk to me 00:00, 11 July 2012 (UTC)
- You give absolutely no reason for why you want it that way. Mythpage88 (talk) 19:36, 11 July 2012 (UTC)
- Why do we have to use that horrible N word? I think GNAA suffices --Camilo Sánchez Talk to me 22:57, 11 July 2012 (UTC)
- Since when is Wikipedia censored? ("'being objectionable' is generally not sufficient grounds for removal or inclusion of content.") Mythpage88 (talk) 23:59, 11 July 2012 (UTC)
- Why do we have to use that horrible N word? I think GNAA suffices --Camilo Sánchez Talk to me 22:57, 11 July 2012 (UTC)
cupco
edityoure citing evidence that does not exist. I have proof yoyu are selery — Preceding unsigned comment added by Basedircrory (talk • contribs) 21:03, 28 September 2012 (UTC)
Shouldn't the GoP/North Korea be listed under groups? (ie. Sony) -- 67.70.35.44 (talk) 22:21, 23 December 2014 (UTC)
- Personisgaming (talk · contribs) No the 121 may use multiple personas to say it was not them when it really was. Ex:New Romantic Cyber Army, WhoisPersonisgaming (talk) 20:22, 21 October 2019 (UTC)
{{main other}}
editWhy does this template automatically categorize pages that transclude it? (the includeonly statement with {{main other}} placed within in) That seems against the practices of not categorizing pages that translcude navbox templates, since those navboxes may appear on pages outside the scope of the category. The categories should be directly placed into the pages themselves to make it obvious they are being categorized, instead of making it difficult to determine why something is being categorized. -- 67.70.35.44 (talk) 22:27, 23 December 2014 (UTC)
Date: which to use? (Date of public disclosure? Date of discovery?)
edit@A5b: KRACK was actually discovered in 2016, and notified to vendors by mid-2017. It was not publicly disclosed until October 2017.[1] So, your edit seems a bit inappropriate. Any comment, or OK for me to revert? Please WP:PING me if you reply. Thanks! Zazpot (talk) 01:42, 17 October 2017 (UTC)
- Zazpot (talk · contribs), source says "Vanhoef discovered the issue in 2016 but kept working to refine his attack. The researcher sent notifications to some affected vendors in July 2017, and US-CERT sent a broader note to more vendors at the end of August." - so its CVE is 2017-*. Some other attacks listed in the template may be in process of discovering years earlier than published. Which date should we use - date of idea, date of ID reservation or date of wide/open publication? Which date will be more useful for readers: 2016 or nov. 2017 (wide discussion of the attack is in 2017, not in 2016)? What about security holes used by years by some governments to do their targeted attacks, and later rediscovered by open community, like ... for early reports of Heartbleed#Possible_prior_knowledge_and_exploitation (2012 vs 2014) and kleptographic backdoors Dual_EC_DRBG? Or EternalBlue with public release in 2017 is marked as 2017 in the template, not by some unknown year of introduction to Agency's software inplant catalog. `a5b (talk) 02:15, 17 October 2017 (UTC)
- @A5b: fair points. However, the relevant row of the template is headed "Vulnerabilities discovered". As such, the year given should refer to the (first verifiably known) date of discovery, not the date of public disclosure. That said, I would be in favour of renaming the row to "Vulnerabilities publicly disclosed" or "Major vulnerabilities publicly disclosed", since that is effectively what it contains. If we did that, then I would agree with you that the correct date to use would be the date of public disclosure. Sound reasonable? Zazpot (talk) 02:43, 17 October 2017 (UTC)
- Zazpot (talk · contribs), the other date is the date of CVE registration - some things are discussed for time with vendor before fully public release. But the date of public disclosure is probably more relevant to the readers; it will be close to the dates of fix released which may be useful too. (And more work is needed with the KRACK article itself, to add what to fix and what will be never fixed like millions of older/cheaper androids). `a5b (talk) 03:05, 17 October 2017 (UTC)
- @A5b: understood about CVE, but I agree date of public disclosure is likely most relevant (and comprehensible) to readers. Just so I'm clear, would you support changing the row header to "Vulnerabilities publicly disclosed" or "Major vulnerabilities publicly disclosed"? If so, which of those do you think would be best? Thanks again, Zazpot (talk) 03:27, 17 October 2017 (UTC)
- CVE is better than something like author remember when he found errors in the protocol and says the date in some interview (full attack may be not created at the time of initial flaw detection); CVE is allocated by/with vendor; it can be closer to date of fix releasing, and it is clearly visible. But it has no month/days in the number itself (does NVD / MITRE list allocation date?). I think we should sort "Vulnerabilities publicly disclosed" by date of the CVE or by date of public disclosure. And lists require not only active marketing (like it was with dirty cows and other recent holes after Heartbleed with cute logo, personal website, interviews with non-computer press - ref http://www.kalzumeus.com/2014/04/09/what-heartbleed-can-teach-the-oss-community-about-marketing/ 'very emotionally evocative' etc); it needs some reliable source with impact estimation. Is there List of Major Computer Vulnerabilities by Year (by Decade)? (There is single Timeline of computer security hacker history for 2 centuries; there are many List of vulnerable fishes/plants/species, but not lists of vulnerable softwares. And databases like CVE have more than 1000 ids per year; less than percent is successfully marketed to the public). Should the list in template be filtered with CVSS or by millions of users/devices/sites affected or best marketing? `a5b (talk) 03:45, 17 October 2017 (UTC)
- @A5b: understood about CVE, but I agree date of public disclosure is likely most relevant (and comprehensible) to readers. Just so I'm clear, would you support changing the row header to "Vulnerabilities publicly disclosed" or "Major vulnerabilities publicly disclosed"? If so, which of those do you think would be best? Thanks again, Zazpot (talk) 03:27, 17 October 2017 (UTC)
- Zazpot (talk · contribs), the other date is the date of CVE registration - some things are discussed for time with vendor before fully public release. But the date of public disclosure is probably more relevant to the readers; it will be close to the dates of fix released which may be useful too. (And more work is needed with the KRACK article itself, to add what to fix and what will be never fixed like millions of older/cheaper androids). `a5b (talk) 03:05, 17 October 2017 (UTC)
- @A5b: fair points. However, the relevant row of the template is headed "Vulnerabilities discovered". As such, the year given should refer to the (first verifiably known) date of discovery, not the date of public disclosure. That said, I would be in favour of renaming the row to "Vulnerabilities publicly disclosed" or "Major vulnerabilities publicly disclosed", since that is effectively what it contains. If we did that, then I would agree with you that the correct date to use would be the date of public disclosure. Sound reasonable? Zazpot (talk) 02:43, 17 October 2017 (UTC)
- ^ "New KRACK Attack Breaks WPA2 WiFi Protocol". BleepingComputer. Retrieved 17 October 2017.
Add Facebook September 2018 data breach
edit50m users definitely affected; 90m accounts reset; notable website. Seems it should be included. Zazpot (talk) 23:33, 4 October 2018 (UTC)
- @Zazpot: Definitely should be put here. Not sure whether to put it in 2018 (when it was first reported) or 2015 (when it began). I'll put it in 2018 for now --WuTang94 (talk) 23:01, 10 February 2019 (UTC)
- @WuTang94: Thanks. Zazpot (talk) 21:12, 11 February 2019 (UTC)
- There was no "hacking" with the Cambridge Analytica incident. The data was acquired through an app, which was passed on to CA. FallingGravity 04:04, 11 February 2019 (UTC)
- @FallingGravity:Good point. With that being said, how is the FB/Cambridge Analytica incident any different than a data leak or vulnerability discovered by a hacker? (Ex. Exactis or Trustico) It's currently unknown if these vulnerabilities were exploited by malicious parties before they were fixed. --WuTang94 (talk) 21:31, 11 February 2019 (UTC)
2018 Russian cyberattacks on Porton Down and the Organisation for the Prohibition of Chemical Weapons
editSeems these should be added.
- https://www.theguardian.com/world/2018/oct/04/netherlands-halted-russian-cyber-attack-on-chemical-weapons-body
- https://www.theguardian.com/world/2018/oct/04/how-russian-spies-bungled-cyber-attack-on-weapons-watchdog</ref>
- https://www.theguardian.com/world/2018/oct/04/visual-guide-how-dutch-intelligence-thwarted-a-russian-hacking-operation</ref> Zazpot (talk) 23:37, 4 October 2018 (UTC)
2015 onwards Chinese custom chip hardware implant on Supermicro servers
editThis absolutely should be included.
Should the Carder.Su forum count as a hacking group ?
editI honestly believe this because they used hacking methods.
Bvp47
editShould definitely be on the list, but more details are yet to be published.