Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

trigger.dev

Post reply on HN
Print view View original

1–10 of 191 posts

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#2

Post by moh_quz »

Really appreciate the transparency here. Post-mortems like this are vital for the industry.

I'm curious was the exfiltration traffic distinguishable from normal developer traffic?

We've been looking into stricter egress filtering for our dev environments, but it's always a battle between security and breaking npm install

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#4

Post by noman-land »

zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

You can add a gpg key and subkeys to a yubikey and use gpg-agent instead of ssh-agent for ssh auth. When you commit or push, it asks you for a pin for the yubikey to unlock it.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#6

Post by robinhoodexe »

moh_quz wrote: post #2

Really appreciate the transparency here. Post-mortems like this are vital for the industry. I'm curious was the exfiltration traffic distinguishable from normal developer traffic? We've been looking into stricter egress filtering for our dev environments, but it's always a battle between security and breaking npm install

Wouldn’t the IP allowlist feature on the GitHub organisation work wonders for this kind of attack?

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#7

Post by Etheryte »

The approach the attacker took makes little sense to me, perhaps someone else has an explanation for it? At first they monitored what's going on and then silently exfiltrated credentials and private repos. Makes sense so far. But then why make so much noise with trying to force push repositories? It's Git, surely there's a clone of nearly everything on most dev machines etc.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#8

Post by benoau »

zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

You can set up your repo to disable pushing directly to branches like main and require MFA to use the org admin account, so something malicious would need to push to a benign branch and separately be merged into one that deploys come from.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#10

Post by sallveburrpi »

benoau wrote: post #8
zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

You can set up your repo to disable pushing directly to branches like main and require MFA to use the org admin account, so something malicious would need to push to a benign branch and separately be merged into one that deploys come from.

Pushing directly to main seems crazy - for anything that is remotely important I would use a pull request/merge request pattern
Post reply on HN