Microsoft's GitHub account allegedly hacked, 500GB stolen
bleepingcomputer.com
Microsoft's GitHub account allegedly hacked, 500GB stolen
1–10 of 126 posts
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#2So many people were paranoid about Microsoft reading their private source code post-acquisition; turns out it was the other way :)
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#3Sounds sketchy given what the employee from Microsoft commented. The article is also not completely up to date with their “interesting” findings. For example, while a language projection for the Windows Runtime to Rust is interesting, it is also a public repository: https://github.com/microsoft/winrt-rs I’d take this article with a grain of salt until we hear more.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#4So a closed source software company buys an open source tool company, and inadvertently make closed source open source!
Or, in other words, if you want to keep something private, don't put it in the "cloud"!
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#5> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items.
Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released.
> Microsoft employee Sam Smith replied to Under the Breach's tweet stating that he thought the leak was fake as "Msft has a “rule” that GitHub repos must be public within 30 days."
Curious, what does microsoft use internally? Instance of github enterprise? Azure devops?
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#6[deleted]
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#7> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories.
Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to privately self-host, especially if you're a large enterprise, but preferably on-site [1][2] to avoid these types of attacks and in the process to reduce costs like this as many were discussing in other HN discussion [3], but here we are.
If they can do it to Microsoft, they can do it to anyone else who has a GitHub account.
[0] https://news.ycombinator.com/item?id=23057769
[1] https://news.ycombinator.com/item?id=22960579
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#8> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released. > Microsoft employee Sam Smith replied to Under the Breach's tweet stating t…
I don't think the potential leak of source code is the worry for Microsoft here, it is the fact that they got access in the first place, as that could have security implications for other projects.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#9> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…
> If they can do it to Microsoft, they can do it to anyone else who has a GitHub account.
It happened to Cisco as well a while back, I have a copy of that source somewhere.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#10> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…
Isn't the upside of hosted platforms like this that they have teams of people securing and monitoring the platform, which can be a bit much for one person who's self-hosting? I do self-host other things but the article doesn't say anything about how the breach might've occurred (e.g. 2FA not enabled?).