Earlier quoted context omitted.
If they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone with access to the org, they could do everything through the web interface which is signed by a common Github key.
Commits made via the UI aren’t signed at all. There is no “common github key” for signing commits
Canonical Ltd source code repositories have been compromised
51–60 of 78 posts
Re: Canonical Ltd source code repositories have been compromised
#52We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
> Always sign your commits! Unfortunately PGP is fundamentally broken. Any identity (email address) can be trivially DoS'd by anyone, because the keyservers are (by design) write-only databases which anyone can add to. https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d695...
GitHub’s PGP signing feature doesn’t make use of keyservers. You have to explicitly add a PGP key to your account for GitHub to acknowledge that your commits are signed.
Re: Canonical Ltd source code repositories have been compromised
#53So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
Ironically I only use Ubuntu in a sandboxed environment, fresh install every time. I run apt get update and dont do any personal info stuff on it.
This is out of sheer laziness because a USB stick is easier to plug in than Sata. Today I learned it is now has security features as well :)
Canonical is a great thing in my life. Hope they haven't been hit too hard and that they learn how to prevent it.
Re: Canonical Ltd source code repositories have been compromised
#54I was told this several hours ago on IRC - this is not an official statement:
someuser@somewhere.canonical.com: I can confirm that we're aware of the issue, have done some initial remediation (e.g. shutting down CI systems that might pull potentially compromised code) while we do a more in depth investigation.
someotheruser@ubuntu/member/username: And we've of course revoked the access that was abused.
Re: Canonical Ltd source code repositories have been compromised
#55Earlier quoted context omitted.
... and today PGP was poisoned
Link, please?
Probably this: https://www.zdnet.com/article/openpgp-flooded-with-spam-by-u...
It has no effect on GitHub, though, which doesn’t use keyservers as part of its validation process.
Re: Canonical Ltd source code repositories have been compromised
#56So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
Probably not. The vast majority of Ubuntu development occurs on Launchpad. A few important projects are developed on Github, though. Notably, LXC and LXD. The maintainers of these projects are quite active, and would likely have seen any harmful changes being made.
Re: Canonical Ltd source code repositories have been compromised
#57While it’s troubling that this happened isn’t it sort of cool that it’s out in the open for everyone to see? At least due to open source the community can know what happened and even look for changes.
Re: Canonical Ltd source code repositories have been compromised
#58Earlier quoted context omitted.
Git commit hashes are pretty safe.
Aren't they changing the hash algorithm specifically because they're no longer safe?
Theoretically no longer safe, but to insert a compromise commit matching another one that looks like normal code is close to impossible.
Re: Canonical Ltd source code repositories have been compromised
#59So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
Probably not. The vast majority of Ubuntu development occurs on Launchpad. A few important projects are developed on Github, though. Notably, LXC and LXD. The maintainers of these projects are quite active, and would likely have seen any harmful changes being made.
The LXC and LXD repositories are under https://github.com/lxc which is a different Github organization with a much much smaller set of members (17 currently) than CanonicalLtd.
We require 2FA for all accounts under the lxc organization and only grant the access that's actually needed by those contributors. So while it's not impossible that one of our members' credentials may get compromised, especially when considering the use of access token, current access is as restricted as you would expect for those repositories.
It's also worth noting that because of Git's own design, even should one of those accounts get compromised, it would be fairly simple to spot and revert any changes that may have occurred.
Re: Canonical Ltd source code repositories have been compromised
#60So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
Hijacking top comment...
We can confirm that on 2019-07-06 there was a Canonical owned account on GitHub whose credentials were compromised and used to create repositories and issues among other activities. Canonical has removed the compromised account from the Canonical organisation in GitHub and is still investigating the extent of the breach, but there is no indication at this point that any source code or PII was affected.
Furthermore, the Launchpad infrastructure where the Ubuntu distribution is built and maintained is disconnected from GitHub and there is also no indication that it has been affected.
We plan to post a public update after our investigation, audit and remediations are finished.
Thank you, your trust in Canonical is important to us, which is why we make privacy and security a priority.
-David on behalf of Canonical