Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's GitHub account allegedly hacked, 500GB stolen

bleepingcomputer.com

Post reply on HN
Print view View original

71–80 of 126 posts

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#71

Post by nova22033 »

rvz wrote: post #7

> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…

I have already made the case to privately self-host

What makes you think you can do a better job than Microsoft or github?

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#72

Post by zoomablemind »

matheusmoreira wrote: post #40
vorpalhex wrote: post #29

Earlier quoted context omitted.

Private github repositories are private the same way that facebok messages are private - private from your roommate, not from the people who own the platform or determined attackers.

Would be nice if git could store encrypted data and decrypt files on checkout. Repositories could be truly private that way.

Nothing stops one from putting encrypted artifacts into a git repo, encryption could be done via hooks. Except this would negate the delta storage, each version would be completely different, and non diffable.

One can just encrypt the .git folder and wrap the git client to handle the encryption/decryption on use. It's always a question where and how well do you keep the keys.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#73

Post by behindsight »

matheusmoreira wrote: post #40
vorpalhex wrote: post #29

Earlier quoted context omitted.

Private github repositories are private the same way that facebok messages are private - private from your roommate, not from the people who own the platform or determined attackers.

Would be nice if git could store encrypted data and decrypt files on checkout. Repositories could be truly private that way.

Unfortunate timing[0] but that is pretty much what Keybase had implemented a few years ago[1]

1: https://keybase.io/blog/encrypted-git-for-everyone

0: https://blog.zoom.us/wordpress/2020/05/07/zoom-acquires-keyb...

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#74

Post by oplav »

searchableguy wrote: post #5

> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released. > Microsoft employee Sam Smith replied to Under the Breach's tweet stating t…

When I interned on the Office team in 2014, we used something called Source Depot. I’m assuming it’s changed since then.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#75

Post by peterwwillis »

Gentle reminder that any private repository is sensitive, because the people pushing to them might not be as careful with what they push, because it's private.

There are hundreds of different kinds of credentials that can be hidden all throughout the history of a Git repo (in code, in logs, in comments, binary blobs, etc). If you don't have a very robust credential scanner operating continuously, and you have a large organization, you probably have active credentials hidden in your private repos.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#76

Post by fartcannon »

nova22033 wrote: post #71
rvz wrote: post #7

> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…

I have already made the case to privately self-host What makes you think you can do a better job than Microsoft or github?

Smaller target?

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#77

Post by Drip33 »

jacquesm wrote: post #63
Drip33 wrote: post #9

Earlier quoted context omitted.

> If they can do it to Microsoft, they can do it to anyone else who has a GitHub account. It happened to Cisco as well a while back, I have a copy of that source somewhere.

You probably shouldn't readily confess to hoarding stolen property in an online forum.

Not a crime to possess information, not property, that was illegally obtained in either USA or my own country provided you didn't counsel or encourage the original theft.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#78

Post by thinkmassive »

zoomablemind wrote: post #72
matheusmoreira wrote: post #40

Earlier quoted context omitted.

Would be nice if git could store encrypted data and decrypt files on checkout. Repositories could be truly private that way.

Nothing stops one from putting encrypted artifacts into a git repo, encryption could be done via hooks. Except this would negate the delta storage, each version would be completely different, and non diffable. One can just encrypt the .git folder and wrap the git client to handle the encryption/decryption on use. It's always a question where and how well do you keep the keys.

Use a gpg smartcard (yubikey or similar). This is how I store Ansible Vault secrets.

You’re absolutely right about the deltas. Initially I had one secrets file per environment, but as my projects grew I ended up breaking them out to a file per environment-project. Both for storage reasons and because it’s difficult to modify one encrypted file from multiple branches without writing plaintext secrets to disk.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#79

Post by dependenttypes »

I think that "leaked" would be a better choice compared to "stolen". You can't "steal" source code, unless if somehow you remove the original (such as if the source code is stored on paper in a safe somewhere and there are no copies and someone goes and steals it).

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#80

Post by dependenttypes »

tlbsofware wrote: post #68
scared2 wrote: post #55

Earlier quoted context omitted.

In this sense "hacked" doesn't make sense. 8f everything was intended for open source.

The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.

Having openpgp-signed commits would prevent such an issue.
Post reply on HN