Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

Post reply on HN
Print view View original

211–220 of 317 posts

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#211

Post by ebfe1 »

ebfe1 wrote: post #157

Doing a bit of investigation with github_events in clickhouse, it is quite clear that the accounts used to perform the attack was "2ft2dKo28UazTZ", "mmvojwip" also seems suspicious: https://play.clickhouse.com/play?user=play#c2VsZWN0ICogZnJvb... Actions taken by the threat actor at the time can be seen here: https://play.clickhouse.com/play?user=play#c2VsZWN0ICogZnJvb...

It seems i forgot to cater for the quota applied to free "play" user in ClickHouse in my previous query... In fact, the threat actor did a lot more... this should give a better list of actions that was performed - Clearly showed he was testing his payload:

https://play.clickhouse.com/play?user=play#c2VsZWN0ICogZnJvb...

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#212

Post by mlfreeman »

lenkite wrote: post #163
mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

This is why I have begin to prefer languages with comprehensive, batteries-included standard libraries so that you need very few dependencies. Dep Management has become a full time headache nowadays with significant effort going into CVE analysis.

I think this is the root of the problem.

I think library/runtime makers aren't saying "let's make an official/blessed take on this thing that a large number of users are doing" as much as they should.

Popular libraries for a given runtime/language should be funded/bought/cloned by the runtime makers (e.g. MS for .NET, IBM/Oracle for Java) more than they are now.

I know someone will inevitably mention concerns about monopolies/anti-trust/"stifling innovation" but I don't really care. Sometimes you have to standardize some things to unlock new opportunities.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#213

Post by SAI_Peregrinus »

m4rtink wrote: post #174

Another reason why you should be getting software via distro, with searate maintainers taking care of it there rather than directly from the developers that can inject malware via the very next version you mindlessly pull in without checking. Also due to here being usually more than one distro, more people will look at the code & can spot the usptream getting rogue or getting compromised.

Adding MITM to your chain of trust doesn't make it more trustworthy, it adds an extra possible attacker.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#214

Post by semiquaver »

diggan wrote: post #201
rarkins wrote: post #177

Hi, Renovate author/maintainer here. The affected repo has now been taken down, so I am writing this partly from memory, but I believe the scenario is: 1. An attacker had write access to the tj-actions/changed-files repo 2. The attacker chose to spoof a Renovate commit, in fact they spoofed the most recent commit in the same repo, which came from Renovate 3. Important: this spoofing of commits wasn't done to "trick"…

> 6. Some people had automerging of such updates enabled, but this is not Renovate's default behavior. Even without automerging, an action like this might be able to achieve its aim only with a PR, if it's run as part of PR builds I'm not sure how this could exploited by just making a PR, unless you for some reason have secrets enabled for builds by unknown contributors, which obviously would be a mistake. Usually, o…

  > I'm not sure how this could exploited by just making a PR, unless you for some reason have secrets enabled for builds by unknown contributors
In this context the renovate bot would be making the PR to a repo it had been installed on, making it a trusted contributor able to trigger CI builds on its PRs.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#215

Post by mixologic »

v1sionSec wrote: post #198
imnotjames wrote: post #187

Earlier quoted context omitted.

Your secrets will be published to the CI log if you were affected. I believe it's everything since around 10pm ET last night. I would consider any runs in the past 24 hours to be suspect.

Thank you, unfortunately we have a multiple of repositories with multiple runs that use this action so checking the logs one by one will be hard. Any idea how to get all logs? Thank you

also the secrets will be published as double base 64 encoded, so it will just look like a string of random chars at the end of the changed-files action in the log.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#216

Post by isamu_2000 »

jtwaleson wrote: post #162
skwashd wrote: post #160

The GitHub repo and org disappeared while I was poking around. Both https://github.com/tj-actions and https://github.com/tj-actions/changed-files return 404.

Is there a safe fork somewhere?

https://github.com/dorny/paths-filter ? looking into it.

Definitely going through and pinning all my 3rd party actions to specific commits e.g. party/package@.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#217

Post by touristtam »

mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

I have used https://github.com/lirantal/npq for a good while now, but I am yearning for that'd look deeper into the health of the package at hand.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#218

Post by semiquaver »

harrisi wrote: post #68
remram wrote: post #63

Earlier quoted context omitted.

No the "v4" tag gets updated from v4.1 to v4.2 etc as those minor versions are released. They are branches, functionally.

Wow, thank you (and the other person that pointed this out to me). That's madness.

You can pin actions to a git sha to prevent this but people generally do not. Action authors would prefer their updates be picked up automatically.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#219

Post by sestep »

diggan wrote: post #202
werrett wrote: post #70

Earlier quoted context omitted.

Exactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit. See https://github.com/tj-actions/changed-files/tags All the tags point to commit `^0e58ed8` https://github.com/tj-actions/changed-files/commit/0e58ed867...

Correct me if I'm wrong, but you would be able to prevent this specific issues with the "Rules" in order to block updates of tags; https://github.blog/news-insights/product-news/github-reposi...

Yeah but no GitHub Action is going to do this because updating tags is the de facto mechanism for releasing patches for those repositories.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#220

Post by redserk »

bombcar wrote: post #116
redserk wrote: post #52

Earlier quoted context omitted.

I’ve been doing all of my dev work in a virtual machine as a way to clamp things down. I’ve even started using a browser in a VM as a primary browser. Computers are fast enough where the overhead doesn’t feel like it’s there for what I do. For development, I think Vagrant should make a comeback as one of the first things to setup in a repo/group of repos.

https://www.qubes-os.org/ is the extension of this.

I’m not sure I can recommend Qubes entirely due to the usability aspect.

I’ve used Qubes several times for a week at a time over the last few years. It’s gotten better, but they really need someone to look at the user experience of it all for it to be a compelling option.

I’m regularly questioning myself if what I’m doing is making it less secure because I don’t understand exactly everything Qubes is doing. I know how all the pieces work individually (Xen, etc).

Outside of configuration, I believe I’d have to ditch any hope of running 3D-anything with any expectation of performance. That’s simply a non-starter as someone who has written off “nation-state actor targeting me, specifically” as something I can defend against.

And lastly, I’m deeply skeptical of anything that loudly wears the Snowden-badge-of-approval as that seems to follow grifts.

My main workstation is a Mac and I’m doing this on Parallels. Would Qubes probably be more secure? Maybe. But it comes at a massive usability hit.

Post reply on HN