For those wondering about Blackmeta's supposed reasoning for hacking the Internet Archive: It seems to be because it's "based in the US"? So it doesn't matter to Blackmeta what good they do for people globally if they're a US based organization. Pretty narrow minded, to say the least. I'm pro palestine, but I think we can all agree that the logic doesn't logic very well.

Screenshots I snagged from their Telegram group chat.

#internetarchive #compromise #ddos #blackmeta #darkmeta #hacktivism #palestine #eliron

Despite messages of the Internet Archive and Wayback Machine were fully up again after the DDoS in the last few days (usually starting at around 20:00 UTC, lasting for hours at a time, but today at 10:00 UTC), countermeasures of their password breach at the end of September and defacement yesterday, today they still had Wayback Machine archiving issues:

Wayback Machine cannot archive threadreaderapp: domain not found; for other web pages it often returns 404 page not found.

Wayback Machine cannot archive tweets: returning 404 page not found

Now they are completely down:

Wayback Machine page cannot load due to time-out.

Only 3 hours after this long [WaybackCrickets/WaybackSave/Archive] Thread by @troyhunt on Thread Reader App on Twitter [WaybackSave/Archive] start tweet, they came forward themselves that they were – in chronological order, unlike their tweet – breached, DDoS-ed and defaced:

[Wayback/Archive] Brewster Kahle on X: “What we know: DDOS attack–fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords. What we’ve done: Disabled the JS library, scrubbing systems, upgrading security. Will share more as we know it.”

[WaybackSave/Archive] Thread by @brewster_kahle on Thread Reader App (single message)

(note the ThreadReaderApp threads because the Wayback Machine has been failing to display Tweets that have been archived since spring 2024)

Similarly, they have not responded to contact attempts from at least these tech outlets yet:

• [WaybackSave/Archive] Internet Archive Breach Exposes 31 Million Users | WIRED
  

  The hack exposed the data of 31 million users as the embattled Wayback Machine maker scrambles to stay online and contain the fallout of digital—and legal—attacks.

• [WaybackSave/Archive] Internet Archive hacked, data breach impacts 31 million users
  

  Internet Archive’s “The Wayback Machine” has suffered a data breach after a threat actor compromised the website and stole a user authentication database containing 31 million unique records.

  News of the breach began circulating Wednesday afternoon after visitors to archive.org began seeing a JavaScript alert created by the hacker, stating that the Internet Archive was breached.

  “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!,” reads a JavaScript alert shown on the compromised archive.org site.

• [WaybackSave/Archive] The Internet Archive is under attack, with a breach revealing info for 31 million accounts – The Verge
  

  A popup message said the online archive has suffered “a catastrophic security breach,” as its operators say the site has been DDoS’d for days.

Troy posted his thread about one hour after this reply to Brewster Kahle: [WaybackSave/Archive] Tom Warren on X: “@brewster_kahle @internetarchive was it a little more than a DDoS?” (which attached the topmost picture in this blog post: thanks Tom!) and confirmation [WaybackSave/Archive] ave on X: “@tomwarren @brewster_kahle @internetarchive ah snap” (image on the right with HIBP email warning).

Of course it was also on large community sites like:

• [WaybackSave/Archive] Reddit – Archive.org just gave me a pop up about a security breach. : cybersecurity
• [Wayback/Archive] Internet Archive: Security breach alert | Hacker News
  

  …

  This isn’t something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader’s IA account email address. So from a security perspective it’s bad but from a privacy perspective a lot of users probably weren’t aware of this detail if they’ve uploaded anything.

  …

I wasn’t aware of the last point. Can’t check either now: even the main archive.org site is currently unreachable.

Consequences?

Not sure if this was actually their first time getting breached, but it is the first time I remember since using them since the late 1990’s. It proves that no matter what web-sites one runs or uses, any of them can be breached: all the more reasons to use different passwords for each.

From the Internet Archive communication it is not yet clear of the hackers are really out (and cannot access changed passwords). Hopefully that information will be available soon, but it might mean you need to re-change your Internet Archive password again.

It means we have to do with the information at [WaybackSave/Archive] Internet Archive (@internetarchive) / X for now.

It also means that currently it is unclear if or how much the content of the Internet Archive has been poisoned by the adversaries.

Edit 20241011T0115: all Internet Archive data seems to be in tact as per tweet from Brewster Kahle

[WaybackSave/Archive] Brewster Kahle on X: “Update: @internetarchive’s data has not been corrupted. Services are currently stopped to upgrade internal systems. We are working to restore services as quickly and safely as possible. Sorry for this disruption.”

I think stopping the services to verify integrity is an extremely good step taken.

In the mean time, Archive Today is very very busy.

Are these the adversaries?

The self proclaimed adversaries seem to link anything USA/Europe/Israel as bad actors:

Luckily there are tweet contexts (pending) and replies debunking this.

Edit 20241010 16:00: DDoS again to Internet Archive and Wayback Machine; Open Library also affected

About half an hour after the Wayback Machine became unAs a reply to his previous Tweet, Brewster Kahle replied this:

[WaybackSave/Archive] Brewster Kahle on X: “Sorry, but DDOS folks are back and knocked knocked archive.org and openlibrary.org offline. @internetarchive is being cautious and prioritizing keeping data safe at the expense of service availability. Will share more as we know it.”

[WaybackSave/Archive]

I wasn’t aware that Open Library was an Internet Archive project, but in retrospect that’s of course obvious.

• Open Library – Wikipedia
• [Archive] Welcome to Open Library | Open Library
• [Wayback/Archive] GitHub – internetarchive/openlibrary: One webpage for every book ever published!

Edit 20241013: systems are slowly starting up; e-mail first

[WaybackSave/Archive] Brewster Kahle on X: “https://t.co/NHtWm9YO4C sub services coming back up when they can, safely.  e.g. Email working. Now contract crawls for National Libraries (important to make keep collections whole) Thank you for the patience.   More as it happens.”

[WaybackSave/Archive] Thread by @brewster_kahle on Thread Reader App –
sub services coming back up when they can, safely. e.g. Email working.

--jeroen

https://wiert.me/2024/10/10/thread-by-troyhunt-the-internet-archive-was-breached-ddosed-and-defaced-reset-your-passwords-its-the-same-account-as-for-their-wayback-machine/

#Darkmeta #SnBlackmeta #SnDarkmeta