Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's GitHub account allegedly hacked, 500GB stolen

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 126 posts

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#41

Post by nrmitchi »

rvz wrote: post #7

> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…

This is leaping to a huge conclusion, but you are correct that if this was a Github data breach, this is clearly a much bigger issue. However, if this was the case, and 1) this "leak" happened on March 28th, and the individual claims to no longer have access to the account, I trust that Github would have proactively communicated with their users about such a large scale event, especially after having fixed it.

This, if true, is almost definitely a compromise and use of a single users' access credentials, which were then rotated (thus the attacked losing access).

I'm not saying that credential stuffing isn't a large-scale problem (I strongly believe that it is, and have even dedicated time to some potential solutions in the past), but jumping from "someone lost their credentials" to "omgz github can't be trusted!" is a bit of a disingenuous leap.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#43

Post by _jal »

bithaze wrote: post #10
rvz wrote: post #7

> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…

Isn't the upside of hosted platforms like this that they have teams of people securing and monitoring the platform, which can be a bit much for one person who's self-hosting? I do self-host other things but the article doesn't say anything about how the breach might've occurred (e.g. 2FA not enabled?).

The counterargument is that a SAAS platform like Github's interests are in the ongoing viability of the service, while my interests are only about in my data in the service.

Those are only somewhat aligned, as anyone with a dispute about terms of service can tell you.

> which can be a bit much for one person who's self-hosting

If your repo serves one person, why do you need your repo to be hosted in public at all? `git init` and a backup are all you need.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#46

Post by input_sh »

cameronbrown wrote: post #33
giancarlostoro wrote: post #32

Earlier quoted context omitted.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Considering Microsoft owns GitHub, there's no reasons their internal teams aren't choosing to host more code on there.

They also have a competing service: Azure DevOps (formerly Team Foundation Server, Visual Studio Team System), which somehow has barely anything to do with Azure.

I believe that the stuff they're open sourcing go on GitHub, while the internal tools go on Azure DevOps. They also have their own VCS (Git alternative) called Team Foundation Version Control (TFVC), though I have no clue why they keep that thing around. They've also had Microsoft Visual SourceSafe, but even they themselves didn't really use that.

On a side note, they really suck at naming things.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#47

Post by ChuckNorris89 »

cameronbrown wrote: post #33
giancarlostoro wrote: post #32

Earlier quoted context omitted.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Considering Microsoft owns GitHub, there's no reasons their internal teams aren't choosing to host more code on there.

They probably had their own internal version control for their IP before they bought GitHub. Can't imagine they suddenly migrated all their stuff to GitHub.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#48

Post by DiabloD3 »

giancarlostoro wrote: post #32
jug wrote: post #3

Sounds sketchy given what the employee from Microsoft commented. The article is also not completely up to date with their “interesting” findings. For example, while a language projection for the Windows Runtime to Rust is interesting, it is also a public repository: https://github.com/microsoft/winrt-rs I’d take this article with a grain of salt until we hear more.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use.

More internal Microsoft code was being hosted by Github instead by Microsoft.

However, the Microsoft account on Github seems to only be public repositories, or repositories being prepped to be public. Actual internal stuff is hosted by one or more Github Enterprise accounts, the alleged hack does not claim they were hacked as well.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#49

Post by ComputerGuru »

cameronbrown wrote: post #33
giancarlostoro wrote: post #32

Earlier quoted context omitted.

I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.

Considering Microsoft owns GitHub, there's no reasons their internal teams aren't choosing to host more code on there.

That acquisition happened a blink of an eye ago, in the grand scheme of things. Things don’t change that fast, especially when you have the sheer amount and scope of DevOps and integrations that MS has. With the possible (but even then still unlikely) exception of greenfield projects, there’s basically no chance that anything but open source (or soon to be open source) MS projects were hosted on GitHub.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#50

Post by DoctorOW »

benatkin wrote: post #36

Microsoft stands to benefit from getting their private code exposed, because they can use it to claim that open source competitors are ripping it off. https://en.wikipedia.org/wiki/ReactOS#Internal_audit https://www.theregister.co.uk/2019/07/03/reactos_windows_res...

From your Wikipedia link:

> Also, the 2004 leaked Windows source code was not seen as legal risk for ReactOS, as the trade secret was considered indefensible in court due to broad spread.

This sounds like Microsoft can't benefit from a public leak.

Post reply on HN