What is the current state? Tags reverted or still poisoned?
User and repo all 404 now. https://github.com/tj-actions https://github.com/tj-actions/changed-files
Damn, so fully pulled, by authors, GitHub or adversary?
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
171–180 of 317 posts
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#172I wish Github required some sort of immutability for actions by default as most package managers do, either by requiring reusable actions to be specified via commit hash or by preventing the code for a published tag to be changed. At the moment the convention is to only specify the tag, which is not only a security issue as we see here, but may also cause workflows to break if an action author updates the action.
You can target `some/action@commithash` already, that's up to you. You're also free to fork or clone each action you use, vet the code, and consume your fork in your workflows. You can also disable the use of third party actions at an org level, or approve them on a case-by-case basis. This all depends on your threat model and risk tolerance, it's not so much a GitHub problem. There will always be bad code that exist…
One problem with this is that actions can be Composite and call arbitrary other actions. So only if you use actions that themselves lock everything by commit for the actions they depend on you're safe.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#173Paid Github organizations have a policy to block third-party actions. Would be nice if there was a way to allow third-party actions as long as they are referenced by hash, not version.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#174Another reason why you should be getting software via distro, with searate maintainers taking care of it there rather than directly from the developers that can inject malware via the very next version you mindlessly pull in without checking.
Also due to here being usually more than one distro, more people will look at the code & can spot the usptream getting rogue or getting compromised.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#175Earlier quoted context omitted.
> Can you really say you trust all of these? We need better capabilities. E.g. when I run `fd`, `rg` or similar such tool, why should it have Internet access? IMHO, just eliminating Internet access for all tools (e.g. in a power mode), might fix this. The second problem is that we have merged CI and CD. The production/release tokens should ideally not be on the same system as the ones doing regular CI. More users nee…
You also need to block write access, so they can’t encrypt all your files with an embedded public key. And read access so they can’t use a timing side channel to read a sensitive file and pass that info to another process with internet privileges to report the secret info back to the bad guy. You get the picture, I’m sure.
I get the picture, yes, namely that probably 99% of project dependencies don't need I/O capabilities at all.
And even if they do, they should be controlled in a granular manner i.e. "package org.ourapp.net.aws can only do network and it can only ping *.aws.com".
Having finer-grained security model that is enforced at a kernel level (and is non-circumventable barring rootkits) is like 20 years overdue at this point.
Every single big org is dragging their feet.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#176Earlier quoted context omitted.
For an example of a scary list of such offers, see https://github.com/extesy/hoverzoom/discussions/670
do you know of any other ones like this that post their offers?
No I don’t. But Wladimir Palant is where I get most of my information on the topic (and is probably where I got this link). His blog might have a post (or a comment) that links to similar lists: https://palant.info/categories/security/
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#177Hi, Renovate author/maintainer here.
The affected repo has now been taken down, so I am writing this partly from memory, but I believe the scenario is:
1. An attacker had write access to the tj-actions/changed-files repo
2. The attacker chose to spoof a Renovate commit, in fact they spoofed the most recent commit in the same repo, which came from Renovate
3. Important: this spoofing of commits wasn't done to "trick" a maintainer into accepting any PR, instead it was just to obfuscate it a little. It was an orphan commit and not on top of main or any other branch
4. As you'd expect, the commit showed up as Unverified, although if we're being realistic, most people don't look at that or enforce signed commits only (the real bot signs its commits)
5. Kind of unrelated, but the "real" Renovate Bot - just like Dependabot presumably - then started proposing PRs to update the action, like it does any other outdated dependency
6. Some people had automerging of such updates enabled, but this is not Renovate's default behavior. Even without automerging, an action like this might be able to achieve its aim only with a PR, if it's run as part of PR builds
7. This incident has reminded that many people mistakenly assume that git tags are immutable, especially if they are in semver format. Although it's rare for such tags to be changed, they are not immutable by design
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#178Earlier quoted context omitted.
For an example of a scary list of such offers, see https://github.com/extesy/hoverzoom/discussions/670
This is why I fork the extensions I use, with the exception of uBlock. Basically just copy the extension folder, if I can't find it on GitHub. That way I can audit the code and not have to worry about an auto-update sneaking in something nefarious. I've had two extensions in the past suddenly start asking for permissions they definitely did not need, and I suspect this is why. Btw, here's a site where you can inspect…
Yeah, and thx for the link to the neat crx explorer.
Close to what you do, I started writing my own addon to replace a couple addons whose featureset I use only partially.
For example, when I use Chromium I want 1. to customize the New Tab page, and 2. to add a keyboard shortcut to pin/unpinTab. These two features are absolutely part of extensions, but in addition to the security risk I find them heavy (I don’t need the kitchen sink, just need 2 micro-features!). And so, I have my little personal addon with zero resource usage with just these two features. It’s tiny (20 lines of code!), git-versioned, and never changes / gets pwned. When I need an extra micro-feature, it’s easy enough to add it by searching addons docs, of asking an LLM.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#179Earlier quoted context omitted.
This is cool but useless because they redacted all the company names. The opposite of a name and shame, because no name and no shame.
It's not useless. It shows the scale at which extension authors get offers for buyouts. The intended buyer doesn't exactly matter.
Precisely. Thank you.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#180Earlier quoted context omitted.
User and repo all 404 now. https://github.com/tj-actions https://github.com/tj-actions/changed-files
Damn, so fully pulled, by authors, GitHub or adversary?
Hey, please tell me how my comment was bad in some way instead of just downvoting. It was a genuine question if anyone might have insight.