Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's GitHub account allegedly hacked, 500GB stolen

bleepingcomputer.com

Post reply on HN
Print view View original

61–70 of 126 posts

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#61

Post by 6c696e7578 »

capableweb wrote: post #15
6c696e7578 wrote: post #4

So a closed source software company buys an open source tool company, and inadvertently make closed source open source! Or, in other words, if you want to keep something private, don't put it in the "cloud"!

Me and a friend were having coffee and were discussing secrets something like 10 years ago. The conclusion of our conversation was "Everything always comes out" (translated from Swedish [context was some gossip that eventually leaked about our common friend]) which boils down to that the only way you can really ensure something stays secret forever, is by only having it in your mind and not sharing it. As soon as you…

Mentally, tell your self there are some very personal photos in the data.

Then most people think more carefully about where they store it :)

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#62

Post by MagnificRogue »

westoque wrote: post #26
colonwqbang wrote: post #21

Earlier quoted context omitted.

Having your repo in Amazon's cloud instead of Microsoft's cloud doesn't mean that you "own" it to a greater degree, does it? It's just a different company holding the keys for you.

True. It's just a lot safer because of how AWS has their permissions/access/ACL setup. Not to mention the attack surface is less since you don't expose your repo organization name, repo users, etc like they have it out in open in GitHub.

How's this different from doing the same thing in Azure?

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#63

Post by jacquesm »

Drip33 wrote: post #9
rvz wrote: post #7

> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…

> If they can do it to Microsoft, they can do it to anyone else who has a GitHub account. It happened to Cisco as well a while back, I have a copy of that source somewhere.

You probably shouldn't readily confess to hoarding stolen property in an online forum.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#64

Post by flak48 »

_jal wrote: post #43
bithaze wrote: post #10

Earlier quoted context omitted.

Isn't the upside of hosted platforms like this that they have teams of people securing and monitoring the platform, which can be a bit much for one person who's self-hosting? I do self-host other things but the article doesn't say anything about how the breach might've occurred (e.g. 2FA not enabled?).

The counterargument is that a SAAS platform like Github's interests are in the ongoing viability of the service, while my interests are only about in my data in the service. Those are only somewhat aligned, as anyone with a dispute about terms of service can tell you. > which can be a bit much for one person who's self-hosting If your repo serves one person, why do you need your repo to be hosted in public at all? `g…

Many consider hosting the repo (privately) on Github etc to be the backup.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#67

Post by lcfcjs2 »

6c696e7578 wrote: post #4

So a closed source software company buys an open source tool company, and inadvertently make closed source open source! Or, in other words, if you want to keep something private, don't put it in the "cloud"!

What about 99% of companies that are hosted in the cloud, and never had a breach?

Your logic is akin to don't drive a car, and you'll never get into a car crash.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#68

Post by tlbsofware »

scared2 wrote: post #55
DiabloD3 wrote: post #48

Earlier quoted context omitted.

Microsoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public rep…

In this sense "hacked" doesn't make sense. 8f everything was intended for open source.

The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#70

Post by buildbot »

searchableguy wrote: post #5

> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released. > Microsoft employee Sam Smith replied to Under the Breach's tweet stating t…

As far as I know, everyone uses azure devops. I don’t know of any teams committing to github, but it would make sense only things that will be open sourced will be placed there.
Post reply on HN