if it is in the cloud, it will be eventually hacked
Wouldn't that mean any computer connected to the internet shares that risk?
Microsoft's GitHub account allegedly hacked, 500GB stolen
51–60 of 126 posts
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#52Microsoft stands to benefit from getting their private code exposed, because they can use it to claim that open source competitors are ripping it off. https://en.wikipedia.org/wiki/ReactOS#Internal_audit https://www.theregister.co.uk/2019/07/03/reactos_windows_res...
That sounds like a fairly weak argument, because IP protections still apply to open source, except for trade secrets. The degree of protection is dictated by a project's license, or if in the absence of a license then a nation's default copyright status.
In your first ReactOS example from 2006 it wasn't even Microsoft that discovered or claimed the problematic code violation. It doesn't look like Microsoft was involved at all.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#53So is there a list somewhere to see if we were affected?
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#54Earlier quoted context omitted.
I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.
Considering Microsoft owns GitHub, there's no reasons their internal teams aren't choosing to host more code on there.
Not my field, but security would clearly be a greater issue for repos held in a publicly accessible site vs those only accessible over a VPN.
Sure, dogfooding is good, but commercially sensitive repos would seemingly - to my naive view - be better on private servers?
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#55Earlier quoted context omitted.
I am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.
Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…
In this sense "hacked" doesn't make sense. 8f everything was intended for open source.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#56if it is in the cloud, it will be eventually hacked
Wouldn't that mean any computer connected to the internet shares that risk?
yeah, that's why in an average on-prem setup you usually would have firewalls, DMZs, IDS/IPS and all the good stuff - and people have been doing on-prem security for decades and accumulated an enormous wealth of knowledge and practice.
in cloud - it all new. people are still figuring out how to deploy their software so that it works both for users and developers. That's why on average onprem is more secure than cloud.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#57500gb is too big, any information about the content?
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#58> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released. > Microsoft employee Sam Smith replied to Under the Breach's tweet stating t…
I don't think the potential leak of source code is the worry for Microsoft here, it is the fact that they got access in the first place, as that could have security implications for other projects.
Well if MS can't secure their own code on GitHub, surely anyone with private repos has to be thinking to jump ship (at least until the flaws are identified and fixed)?
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#59Earlier quoted context omitted.
Wouldn't that mean any computer connected to the internet shares that risk?
yeah, that's why in an average on-prem setup you usually would have firewalls, DMZs, IDS/IPS and all the good stuff - and people have been doing on-prem security for decades and accumulated an enormous wealth of knowledge and practice. in cloud - it all new. people are still figuring out how to deploy their software so that it works both for users and developers. That's why on average onprem is more secure than cloud…
Maybe I'm crazy but I'm not sure all that security makes things more secure than the cloud.
I feel like the hacks I hear about are pretty evenly distributed between cloud and on prem type setups... and most of the big ransomware attacks are almost exclusive to on prem.
Re: Microsoft's GitHub account allegedly hacked, 500GB stolen
#60Earlier quoted context omitted.
Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…
In this sense "hacked" doesn't make sense. 8f everything was intended for open source.
I think there are still two concerns here even if everything is intended to eventually become open source.
One, this doesn't address exactly how the repo was compromised. Likely one of the many folks with access had their credentials compromised, but until we know, there may be risk to other projects. Two, as the article mentions, it may not have had all passwords or API keys scrubbed.