What does GitHub's security team even do?

Interesting article but doesn't seem to understand how security teams work or even how to address a threat outside of an brittle easily bypassed response.

The initial report was investigated and resolved, with the removal of specific repositories. GitHub likely lacks ability to prevent the attacker from repeating the attack (this is potentially a hard technical problem to solve depending on the infrastructure, available telemetry and how the threat actor is performing their attack).

Once that initial report was resolved, the ticket was closed, archived, and the team moved on. No one is going to sit and re-check a blog post to see if it is updated. That just doesn't happen anywhere, not just at GitHub. Likely a separate ticket was created though to see if they could identify the root cause (compromised accounts, spam attack, etc) and potentially address it. That analysis takes time though and AI doesn't provide much value in scaling here (yet).

> All they needed to do was allocate a few days for any regular employee so they could use Copilot to find all these repositories and block them.

That statement in particular shows a poor understanding of malicious repositories. Blocking on a string signature is almost always worthless as that is a brittle signature and very easy for an actor to identify (that the actor is being blocked by said string).

If you're going to block malicious uploads you need something much more concrete than a string. Having a bot search periodically via regular expressions to remove things on a brittle signature runs the risk of blocking a non-malicious repository. Even if the regular expression is perfect, the threat actor would realize relatively quickly what is going on.

If the threat actor is infecting repositories via compromising GitHub accounts, blocking the repository also does little to resolve the problem as the account remains compromised.

Preventing spam or malware problems at scale in any organization the size of GitHub to date not solved well. Social media platforms (using these as an example as they have comparable scale) still struggle with spam and they have more telemetry and experience dealing with such things.

I use this account as an outlet not tied to my actual consulting work so unfortunately I can’t point you to that.

Also, the way I do business is more along the lines of “word of mouth” if that makes sense.

I can tell you though that it’s nothing special. I lead IR operations through compromise to recovery and also train. It’s a “let’s get you out of this and make sure it doesn’t happen again” approach.

Thanks!

I would enjoy a brief exchange, can you hit me up at at dotnet?

Whilst I personally don't have first hand experience with GitHub's security team - your experiences and suppositions perfectly match my own general observations with our sector.

I've had the pleasure of working with absolutely outstanding security professionals, doing exactly what you see - relatively thankless work.

Due to the alignment of incentives, it can in fact be worse than merely thankless and face internal opposition - so the perverse reality of Microsoft/GitHub needing to feel more pain is sadly likely true.

This article's author is wonderfully honest about having not worked at a larger company and is right to call out the issues that are all about organisational alignment/ownership.. or lack thereof.

You could never pay me enough money to be responsible for security at GitHub though, that's for sure.

It's happening for Actions security, at least. I don't know about their other services.