Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

Post reply on HN
Print view View original

111–120 of 317 posts

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#111

Post by from-nibly »

usef- wrote: post #22
mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

Yes. Same with browser plugins. I've heard multiple free-plugin authors say they're receiving regular offers to purchase their projects. I'm sure some must take up the offer.

I got an outreach for an extension I made as a joke. It had like maybe 5000 downloads ever.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#112

Post by sroussey »

mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

Yeah, I’m working on a library where the core is dependency free. It takes longer but I know the provenance of everything—me!

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#113

Post by oefrha »

> https://github.com/tj-actions/changed-files/pull/2460

This kind of auto dependency bump bots are more trouble than their worth. If your app works today, bumping random deps won’t make it work better in any meaningful sense in 95% of cases. With such a small upside, the downside of introducing larger attack surfaces, subtle breakages (despite semver), major breakages, and in the worst cases, compromises (whether it’s a compromised dep, or fake bot commits that people are trained to ignore) just completely outweighs the upside. You’re on the fast lane to compromises by using this kind of crap.

People should really learn from Go’s minimum version selection strategy.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#114

Post by dijksterhuis »

bolognafairy wrote: post #40
throwaway48476 wrote: post #33

Earlier quoted context omitted.

The solution for trusting dependencies is signed public builds and ML 'weirdness' detectors that require manual review.

If this were “the solution”, then the many, many smart individuals and teams tasked with solving these problems throughout the software industry would’ve been out of work for some time now. It’s obviously more complicated than that. Signed public builds don’t inherently mean jack. It highly depends on the underlying trust model. — Malicious actor: “we want to buy your browser extension, and your signing credentials”.…

> Hacker News, as usual, loves to pretend it has all the answers to life’s problems, and the issue is that nobody has listened to them.

eh, it’s not just HN.

like, there’s no single technical/material solution to something as complex and widespread as humanity’s apparent base need to “get more stuff”. which is the root cause for acting maliciously — it’s just “getting more stuff” in a way that’s harmful to others.

but that won’t stop people from claiming that they can come up with a technical solution. whether that’s politicians, tech bros, HN commentators or that guy down the pub on a thursday evening.

—

that being said, signing software is better than doing nothing… so, a better way of phrasing it from the GP would probably have been it is a partial mitigation for the problem in some cases.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#116

Post by bombcar »

redserk wrote: post #52
ashishb wrote: post #39

Earlier quoted context omitted.

> Can you really say you trust all of these? We need better capabilities. E.g. when I run `fd`, `rg` or similar such tool, why should it have Internet access? IMHO, just eliminating Internet access for all tools (e.g. in a power mode), might fix this. The second problem is that we have merged CI and CD. The production/release tokens should ideally not be on the same system as the ones doing regular CI. More users nee…

I’ve been doing all of my dev work in a virtual machine as a way to clamp things down. I’ve even started using a browser in a VM as a primary browser. Computers are fast enough where the overhead doesn’t feel like it’s there for what I do. For development, I think Vagrant should make a comeback as one of the first things to setup in a repo/group of repos.

https://www.qubes-os.org/ is the extension of this.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#117

Post by captn3m0 »

mceachen wrote: post #79
londons_explore wrote: post #65

So this dumps env to stdout using some obfustucated code? And then relies on the fact logs are viewable publicly so the attacker can go scrape your secrets. If so, why did they use obfustucated code? Seems innocuous enough to load env into environment vars, and then later to dump all env vars as part of some debug routine. Eg. 'MYSQL env var not set, mysql integration will be unavailable. Current environment vars: ${…

Presumably the cracker: 1. spoofed an account whose PRs were auto-merged (renovate[bot]) 2. found that `index.js` was marked as binary, and knew that GitHub is "helpful" (for the exploit), and hides diffs in the PR for that file by default 3. shoved the chunk of base64 wayyyy down the commit, so the maintainer had review fatigue by the time they scrolled. Having "memdump.py" in the commit in plaintext would certainly…

Sounds about right to me. We can use a few knowns about GitHub IAM to deduce a few things:

1. There are no deleted PRs or Issues on the repo (2461..2463 are all valid refs)

2. A legitimate `Renovate[Bot]` dep bump would have filed a PR. Last such PR was 5 days ago, and is presumably not the source for this. (I haven't gone through every dep change, but doesn't look like it).

3. That leaves us with the 0e58ed867 commit, which has to be a spoofed commit, since it doesn't belong to a branch and we don't have a corresponding PR(1). A complete takeover of the repo can result in a hanging commit (by deleting the renovate bump branch), but there must be a hanging PR-ref around. Since there isn't one:

4. All of the above points to a compromised account that has write access to the repo.

There is also the https://github.com/tj-actions-bot account, but unclear if it has write access.

Edit: gurchik's guess at https://github.com/tj-actions/changed-files/issues/2463#issu... seems more likely:

> 1. Fork the repository > > 2. Push compromised code to the fork > > 3. Update the tags in the parent repository to point to the SHA of the fork

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#118

Post by captn3m0 »

Helpful update: The gist author has deleted the gist, so https://gist.githubusercontent.com/nikitastupin/30e525b776c4... now results in a 404, and stops the action from any further secrets being leaked. This means you're impacted only if you used the action, and had a build triggered in the last 6 hours or so.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#119

Post by Sytten »

I am surprised nobody here mentionned immutable github actions that are coming [1]. Been waiting for them since the issue was open in 2022. This would have significantly reduce impact and hopefully github will get it over the finish line.

I always fork my actions or at least use a commit hash.

[1] https://github.com/features/preview/immutable-actions

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#120

Post by xboxnolifes »

remram wrote: post #55
ronjouch wrote: post #30

Earlier quoted context omitted.

For an example of a scary list of such offers, see https://github.com/extesy/hoverzoom/discussions/670

This is cool but useless because they redacted all the company names. The opposite of a name and shame, because no name and no shame.

It's not useless. It shows the scale at which extension authors get offers for buyouts. The intended buyer doesn't exactly matter.
Post reply on HN