Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's GitHub account allegedly hacked, 500GB stolen

bleepingcomputer.com

Post reply on HN
Print view View original

91–100 of 126 posts

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#91

Post by algol10 »

nova22033 wrote: post #71
rvz wrote: post #7

> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to priva…

I have already made the case to privately self-host What makes you think you can do a better job than Microsoft or github?

Could this stop? Every time some heretic evades the "cloud" and self-hosts, people (whose income presumably depends on the "cloud") spread FUD.

Here's the security of the "cloud":

https://arstechnica.com/information-technology/2012/03/hacke...

Why on earth should a maintained server that just runs git over ssh be less secure?

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#92

Post by ddlutz »

searchableguy wrote: post #5

> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released. > Microsoft employee Sam Smith replied to Under the Breach's tweet stating t…

When I was in Azure last year we used an internal Git repo named, I think it was named 'onebranch'. There are only two things we posted to a private github.

First was our description of our JSON apis, which would eventually be sent to a public github.

The second was some internal documentation we had for our internal clients. I don't think there were any 'secrets' in there, but it would be documentation for the internal side for internal clients that no outsider could ever use.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#93

Post by jlgaddis »

dependenttypes wrote: post #80
tlbsofware wrote: post #68

Earlier quoted context omitted.

The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.

Having openpgp-signed commits would prevent such an issue.

Would it?

Couldn't the "hacker" have simply generated a new GPG key and added it to the account he had control of?

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#94

Post by binarysneaker »

6c696e7578 wrote: post #4

So a closed source software company buys an open source tool company, and inadvertently make closed source open source! Or, in other words, if you want to keep something private, don't put it in the "cloud"!

Someone else's compu... yeah, yeah. Yawn. Move along.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#96

Post by naringas »

dependenttypes wrote: post #79

I think that "leaked" would be a better choice compared to "stolen". You can't "steal" source code, unless if somehow you remove the original (such as if the source code is stored on paper in a safe somewhere and there are no copies and someone goes and steals it).

or if during the hack, the code was deleted after copying

regardless, I agree.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#97

Post by as300 »

tlbsofware wrote: post #68
scared2 wrote: post #55

Earlier quoted context omitted.

In this sense "hacked" doesn't make sense. 8f everything was intended for open source.

The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.

Sure, but isn't the point of git to be able to roll back all changes on any branch? And since GitHub is owned by Microsoft, they themselves would surely be able to regain ownership of the account.

This seems like a non-story.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#98

Post by whymauri »

searchableguy wrote: post #5

> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released. > Microsoft employee Sam Smith replied to Under the Breach's tweet stating t…

I used Azure DevOps while at NERD in 2019.

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#99

Post by MauranKilom »

as300 wrote: post #97
tlbsofware wrote: post #68

Earlier quoted context omitted.

The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.

Sure, but isn't the point of git to be able to roll back all changes on any branch? And since GitHub is owned by Microsoft, they themselves would surely be able to regain ownership of the account. This seems like a non-story.

How much code with malicious modifications has been pulled from these repos since then? There's no evidence this happened, but we can't just handwave it away with "we can undo changes".

Re: Microsoft's GitHub account allegedly hacked, 500GB stolen

#100

Post by orta »

factorialboy wrote: post #83

From the article: > Microsoft employee Sam Smith replied to Under the Breach’s tweet stating that he thought the leak was fake as “Msft has a “rule” that GitHub repos must be public within 30 days.” Does that mean MS bans the use of GitHub for permanently storing private repos?

We (the TypeScript team) have a bunch of private repos (blog post drafts, planning docs, reproduction repos, rando internal tooling ) on GitHub that are many years old. I'm pretty sure that Sam was mistaken here.
Post reply on HN