Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

Post reply on HN
Print view View original

201–210 of 317 posts

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#201

Post by diggan »

rarkins wrote: post #177

Hi, Renovate author/maintainer here. The affected repo has now been taken down, so I am writing this partly from memory, but I believe the scenario is: 1. An attacker had write access to the tj-actions/changed-files repo 2. The attacker chose to spoof a Renovate commit, in fact they spoofed the most recent commit in the same repo, which came from Renovate 3. Important: this spoofing of commits wasn't done to "trick"…

> 6. Some people had automerging of such updates enabled, but this is not Renovate's default behavior. Even without automerging, an action like this might be able to achieve its aim only with a PR, if it's run as part of PR builds

I'm not sure how this could exploited by just making a PR, unless you for some reason have secrets enabled for builds by unknown contributors, which obviously would be a mistake. Usually, only builds using secrets only run on certain branches which has a known contributor approving the code before it gets there.

> people mistakenly assume that git tags are immutable

If you're distributing a library on GitHub used by many other people/projects, then you really need to setup `protected branches` and `protected tags`, where you can prevent changes somewhat.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#202

Post by diggan »

werrett wrote: post #70
remram wrote: post #63

Earlier quoted context omitted.

No the "v4" tag gets updated from v4.1 to v4.2 etc as those minor versions are released. They are branches, functionally.

Exactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit. See https://github.com/tj-actions/changed-files/tags All the tags point to commit `^0e58ed8` https://github.com/tj-actions/changed-files/commit/0e58ed867...

Correct me if I'm wrong, but you would be able to prevent this specific issues with the "Rules" in order to block updates of tags; https://github.blog/news-insights/product-news/github-reposi...

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#203

Post by nextaccountic »

ashishb wrote: post #39
mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

> Can you really say you trust all of these? We need better capabilities. E.g. when I run `fd`, `rg` or similar such tool, why should it have Internet access? IMHO, just eliminating Internet access for all tools (e.g. in a power mode), might fix this. The second problem is that we have merged CI and CD. The production/release tokens should ideally not be on the same system as the ones doing regular CI. More users nee…

> We need better capabilities. E.g. when I run `fd`, `rg` or similar such tool, why should it have Internet access?

Yeah!! We really need to auto sandbox everything by default, like mobile OSes. Or the web.

People browse the web (well, except Richard Stallman) all the time, and run tons of wildly untrusted code, many of them malicious. And apart from zero days here and there, people don't pay much attention to it, and will happily enter any random website in the same machine they also store sensitive data.

At the same time, when I open a random project from Github on VSCode, it asks whether the project is "trusted". If not, it doesn't run the majority of features like LSP server. And why not? Because the OS doesn't sandbox stuff by default. It's maddening.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#204

Post by alper »

v1sionSec wrote: post #199

As the repo is was taken down is someone able to tell me when was the malicious commit pushed. Trying to get a timeline to see if any workflows using this action were trigger in that timeframe. Thank you

Somewhere after 18:00 CET Friday.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#207

Post by oefrha »

lostmsu wrote: post #196
oefrha wrote: post #113

> https://github.com/tj-actions/changed-files/pull/2460 This kind of auto dependency bump bots are more trouble than their worth. If your app works today, bumping random deps won’t make it work better in any meaningful sense in 95% of cases. With such a small upside, the downside of introducing larger attack surfaces, subtle breakages (despite semver), major breakages, and in the worst cases, compromises (whether it’…

Your app will have unpatched vulnerabilities.

As long as you subscribe to security advisories, it’s a lot more likely that new vulnerabilities are introduced than old undiscovered vulnerabilities are accidentally patched. In fact barring rewrites (which usually won’t be picked up by semver-respecting auto bumps anyway) I can hardly think of an example of the latter.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#209

Post by trallnag »

greatgib wrote: post #181

Honestly now most people doing "modern software engineering" are retards with no concept of real software engineering concepts. Shitload of cardboard cto are pushing for "modern practice" to use whatever new version of whatever random dependency downloaded straight from internet. Some persons asked why I don't like Ruff or UV for Python for example? You start a new job, first thing you have to do after installing a s…

There are usually several different ways to install tools like uv. For example, uv is available as a Homebrew formula.

And regarding pre-commit: It usually relies on external code, but it is not a requirement. Pre-commit can also be used to just run arbitrary commands and scripts defined within the pre-commit config using the values "system" or "script" for the "language" key.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#210

Post by cyrnel »

kurmiashish wrote: post #5

Disclaimer: I am a co-founder of StepSecurity. StepSecurity Harden-Runner detected this security incident by continuously monitoring outbound network calls from GitHub Actions workflows and generating a baseline of expected behaviors. When the compromised tj-actions/changed-files Action was executed, Harden-Runner flagged it due to an unexpected endpoint appearing in the network traffic—an anomaly that deviated from…

The advertising in this article is making it actively difficult to figure out how to remediate this issue. The "recovery steps" section just says "start our 14 day free trial".

The security industry tolerates self-promotion only to the extent that the threat research benefits everyone.

Post reply on HN