[WikiEN-l] Trojan admins, is it a real problem?

[Andrew Gray]

On 18/06/07, Ron Ritzman <ritzman at gmail.com> wrote:
> On 6/15/07, Slim Virgin <slimvirgin at gmail.com> wrote:
>
> > Trojan admin accounts can do a lot of damage. They can view and copy
> > deleted material; unblock abusive users; unprotect pages that would be
> > better left protected; cause endless arguments on AN/I by questioning
> > other admins; log and hand out conversations on the admins' channel,
> > and doubtless other things I haven't thought of.
>
> With all the talk about this "trojan admin" business, this question
> has to be asked. Is there any evidence that this is actually happening
> or has happened? Have any trojan admin accounts been desysopped and
> blocked?

We had a spate of delete-the-main-page-etc vandalism from admin
accounts about a month or two back; five or so were desysopped. Of
those, I believe most were forcibly cracked via bad passwords; one was
possibly malicious (I haven't followed up since, so I can't say what
was decided.) There was also a similar case a little time before with
an admin who had quit - this one did appear to be them "going out with
a bang", as it were, rather than a broken account.

Corrections welcomed.

-- 
- Andrew Gray
  andrew.gray at dunelm.org.uk