Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

Post reply on HN
Print view View original

91–100 of 317 posts

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#91

Post by Terr_ »

password4321 wrote: post #71
Terr_ wrote: post #48

Earlier quoted context omitted.

> commit hashes There is some latent concern that most git installations use SHA-1 hashes, as opposed to SHA-256. [0] Also the trick of creating a branch that happens to be named the same as a revision, which then takes precedence for certain commands. [0] https://git-scm.com/docs/hash-function-transition

creating a branch that happens to be named the same as a revision, which then takes precedence for certain commands TIL; yikes! (and thanks)

A signed commit [0] might be good for internal devops stuff (e.g. "yes, we really do want this version in production") but unfortunately that's not gonna work for pulling in third-party tooling, since most won't use it.

[0]https://git-scm.com/book/ms/v2/Git-Tools-Signing-Your-Work

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#92

Post by zahlman »

werrett wrote: post #77
edoceo wrote: post #57

Noob question: is it possible to version lock these things? Could one "vendor" these tools into a fork and use that in the pipeline? Maybe it's one of those possible but crazy endeavour?

You can pin GitHub Actions to specific versions or specific commits. But note you can change version tags arbitrarily. In this specific case, the bad actor changes all of the version tags to point to their malicious commit: https://github.com/tj-actions/changed-files/tags So to avoid that you'd have to pin your GitHub Action to specific commits as outlined in this SO post: https://stackoverflow.com/a/78905195

> In this specific case, the bad actor changes all of the version tags to point to their malicious commit: https://github.com/tj-actions/changed-files/tags

This required compromising the entire repository, yes? It can't be explained as the maintainer being tricked into merging something malicious?

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#93

Post by sangeeth96 »

Don’t want to be alarmist but even if not using this action directly, I wonder what implications might be if this has leaked tokens from prominent public-facing project repos which might be used by several folks? I spotted an issue[1] to fix this in Expo EAS CLI and I’m guessing there are many more. The payload I saw from the report only seems to dump things to stdout but I guess analysis is still in progress and IDK if it’s the same payload for all the tags.

[1]: https://github.com/expo/eas-cli/pull/2948/files

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#94

Post by fluidcruft »

Gigachad wrote: post #67
usef- wrote: post #22

Earlier quoted context omitted.

Yes. Same with browser plugins. I've heard multiple free-plugin authors say they're receiving regular offers to purchase their projects. I'm sure some must take up the offer.

I have long since stopped using any extension that doesn’t belong to an actual company (password managers for example). Even if they aren’t malware when you installed them, they will be after they get sold.

Actual companies also get sold and churned into shit. See LastPass for example.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#95

Post by eviks »

naikrovek wrote: post #45

I’ve been saying for a while that there aren’t supply chain problems when the supply chain is the problem. I’m getting to the point where I feel that library use at all should be frowned upon, unless it is your own library, with obvious exceptions for the most widely used things like encryption and authentication. None of these things are particularly difficult, people just don’t want to do them “oh noes my velocity”

And writing your library should be frowned upon because you can easily add a major security vulnerability with your own two hands

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#97

Post by sureIy »

themgt wrote: post #85

This is hilarious, the maven-lockfile project "Lockfiles for Maven. Pin your dependencies. Build with integrity" appears to have auto-merged a PR for the compromised action commit. So the real renovate bot immediately took the exfiltration commit from the fake renovate bot and started auto-merging it into other projects: https://github.com/chains-project/maven-lockfile/pull/1111

The fun part is that they used commits specifically for security, but then add an auto-updater. Might as well use tags.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#99

Post by mdaniel »

themgt wrote: post #85

This is hilarious, the maven-lockfile project "Lockfiles for Maven. Pin your dependencies. Build with integrity" appears to have auto-merged a PR for the compromised action commit. So the real renovate bot immediately took the exfiltration commit from the fake renovate bot and started auto-merging it into other projects: https://github.com/chains-project/maven-lockfile/pull/1111

heh, timing is everything https://github.com/chains-project/maven-lockfile/issues/1085...

> After some cleanup the changed-files (https://github.com/tj-actions/changed-files) action seems to be more work to remove. It would be awesome if it could be added to the allowlist

> Done. Allowed all versions of this action. Should I pin it to one version in the allowlist (won't be convenient if renovate updates this dependency)?

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#100

Post by jeeyoungk »

mellosouls wrote: post #98

A list of projects claimed to be using it from the GitHub page: https://github.com/tj-actions/changed-files?tab=readme-ov-fi...

Looks like a lot of them are pinning to tags (which are not guaranteed to change) or SHA (https://github.com/vitejs/vite/blob/8da04227d6f818a8ad9efc00...) which is more hermetic.
Post reply on HN