Ghrc.io appears to be malicious • Hacker News Board

Re: Ghrc.io appears to be malicious

#21

Post by JdeBP » Mon, Aug 25, 2025, 12:44 AM UTC

Atreiden wrote: post #3

Fairly compelling attack vector because it took several readings for me to even see the problem with the domain.

You and many others. Including people who retry multiple times, and even reboot their machines.

* https://stackoverflow.com/a/66985424/340790 (Spot the answerer's account name!)

* https://forums.docker.com/t/docker-unable-to-push-to-ghrc-io...

Re: Ghrc.io appears to be malicious

#22

Post by notsahil » Mon, Aug 25, 2025, 12:46 AM UTC

aussieguy1234 wrote: post #6

There are alot of open source projects using this domain https://github.com/search?q=ghrc.io&type=code

GitHub should a have tool internally to create bulk and send it as a fix

Re: Ghrc.io appears to be malicious

#23

Post by TZubiri » Mon, Aug 25, 2025, 12:54 AM UTC

Reminder not to use goofy TLDs, being cute is not worth it when compared to security. There's no guarantees that the process for taking down a malicious domain will be as smooth as a .com.

I'd rather deal with US verisign rather than the British Indian Ocean territory or colombia or anguila

Re: Ghrc.io appears to be malicious

#24

Post by dcrazy » Mon, Aug 25, 2025, 12:58 AM UTC

Gigachad wrote: post #14

echelon wrote: post #10

Earlier quoted context omitted.

The problem here is GitHub's terrible domain name. The container registry has a horrible name.

Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.

It’s best security practice to host user-generated content on a separate domain to opt into browsers’ cross-domain security policies. Hence ghcr.io, githubusercontent.com, fbimg.com, etc.

https://www.reddit.com/r/webdev/comments/lg9xnm/why_do_some_...

Re: Ghrc.io appears to be malicious

#25

Post by cyral » Mon, Aug 25, 2025, 1:02 AM UTC

Gigachad wrote: post #14

echelon wrote: post #10

Earlier quoted context omitted.

The problem here is GitHub's terrible domain name. The container registry has a horrible name.

Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.

I've noticed this too. Why does amazon have aboutamazon.com and Google have developers.googleblog.com? They literally have their own .google TLD but still choose this weird domain.

Same with local governments. They love something really random like proptaxpayment.org instead of treasurer..gov. It's exactly the kind of domain you are told to watch out for, but actually legit.

Re: Ghrc.io appears to be malicious

#26

Post by thaeli » Mon, Aug 25, 2025, 1:06 AM UTC

nicce wrote: post #9

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558

Are there any additional mitigations folks are using for this? This issue is the only reason we can’t turn classic PATs off entirely.

Short lifetime mandatory reauth to enterprise SSO seems to be the best available, but it’s inconvenient for the single Classic PAT we actually need.

Re: Ghrc.io appears to be malicious

#27

Post by gruez » Mon, Aug 25, 2025, 1:39 AM UTC

whois says it's registered by dynadot, so it's probably worth contacting their abuse email: abuse@dynadot.com

Re: Ghrc.io appears to be malicious

#28

Post by lathiat » Mon, Aug 25, 2025, 1:52 AM UTC

aussieguy1234 wrote: post #6

There are alot of open source projects using this domain https://github.com/search?q=ghrc.io&type=code

That's a fairly impressively sized list.

Re: Ghrc.io appears to be malicious

#29

Post by bragr » Mon, Aug 25, 2025, 1:58 AM UTC

TZubiri wrote: post #23

Reminder not to use goofy TLDs, being cute is not worth it when compared to security. There's no guarantees that the process for taking down a malicious domain will be as smooth as a .com. I'd rather deal with US verisign rather than the British Indian Ocean territory or colombia or anguila

The .io TLD is administered by Afilias which is an American corporation.

Re: Ghrc.io appears to be malicious

#30

Post by javchz » Mon, Aug 25, 2025, 2:38 AM UTC

SoftTalker wrote: post #4

arjvik wrote: post #2

Took the article pointing out that the c and r were transposed for me to even notice there was a problem!

Yep this is the sort of typo error I make probably 10 times a day.

What it's funny it's that because tokenization there is a non zero chance a LLM audit may not see anything wrong here, similar to the strawberry problem.