Github seems to be experiencing security issues • Hacker News Board

Re: Github seems to be experiencing security issues

#11

Post by sebslomski » Tue, Nov 19, 2013, 8:42 AM UTC

user.failed_login: Originated from http://ipinfo.io/190.203.225.87 12 hours ago

user.failed_login: Originated from http://ipinfo.io/186.88.197.206 18 hours ago

user.failed_login: Originated from http://ipinfo.io/182.253.48.4 a day ago

user.failed_login: Originated from http://ipinfo.io/94.134.190.4 a day ago

user.failed_login: Originated from http://ipinfo.io/186.94.244.213 2 days ago

user.failed_login: Originated from http://ipinfo.io/109.122.92.52 2 days ago

Re: Github seems to be experiencing security issues

#12

Post by ThatOtherPerson » Tue, Nov 19, 2013, 8:44 AM UTC

SilkRoadie wrote: post #3

Why does this page mean GitHub is experiencing security issues? I didn't know this page existed. Its pretty handy, though I don't like how it shows failed logins. 6 attempts in the past 24 hours unnerves me. Probably trying my email and my use-all password from vBulletin or one of the numerous other sites which have been broken into.

Check your previous history. You probably don't have many failed attempts before the past 24 hours. It seems to be some sort of botnet attack.

Re: Github seems to be experiencing security issues

#13

Post by wgx » Tue, Nov 19, 2013, 8:50 AM UTC

The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts.

As anyone who's put an EC2 up without securing it knows, an automated SSH attempt at 'root' will be made within a few hours of it coming online.

Re: Github seems to be experiencing security issues

#14

Post by notwedtm » Tue, Nov 19, 2013, 8:53 AM UTC

A reply from Zach Holman on twitter confirms that it's an automated attack that they are currently working on mitigating: https://twitter.com/holman/status/402720736650874880

Re: Github seems to be experiencing security issues

#15

Post by TheDom » Tue, Nov 19, 2013, 8:54 AM UTC

aram wrote: post #5

Very strange; I just checked my security history and see that there have been 5 unsuccessful login attempts from China/Venezuela to my account (last 14 hours). Everything before that is pretty clean and without fake logins. Does anyone have more information on this?

I can confirm this.

  user.failed_login: Originated from 190.79.223.49 2 days ago
  user.failed_login: Originated from 78.108.63.44 4 days ago

Re: Github seems to be experiencing security issues

#16

Post by simonw » Tue, Nov 19, 2013, 8:59 AM UTC

I wonder if these failed login attempts are using passwords from the Adobe breach.

Re: Github seems to be experiencing security issues

#17

Post by daGrevis » Tue, Nov 19, 2013, 9:00 AM UTC

Someone from Venezuela tried to log in, but failed.

Re: Github seems to be experiencing security issues

#18

Post by junto » Tue, Nov 19, 2013, 9:04 AM UTC

simonw wrote: post #16

I wonder if these failed login attempts are using passwords from the Adobe breach.

I think that is unlikely. The Adobe breach data looked like this:

   84557956-|--|-[redacted]@parponline.org-|-0tlHzKbr18uO6Wu5iaXtPQ==-|-mother's maiden name-Wilson|--

These logins are targeted at usernames. Adobe data didn't contain usernames, hence I don't understand how the Adobe data could help here.

  user.failed_login

  actor	
  actor_ip	201.20.72.120
  created_at	2013-11-18 21:03:47
  note	From GitHub.com
  user

Re: Github seems to be experiencing security issues

#19

Post by masklinn » Tue, Nov 19, 2013, 9:07 AM UTC

aaronpk wrote: post #4

I don't get it... this is my own security page which looks normal to me. [edit] I see one failed login attempt from a chinese IP like other people are saying. Maybe that is what OP meant to point out?

On mine I see 13 different login attempts, in about 8 hours.

Re: Github seems to be experiencing security issues

#20

Post by nodata » Tue, Nov 19, 2013, 9:16 AM UTC

junto wrote: post #18

simonw wrote: post #16

I wonder if these failed login attempts are using passwords from the Adobe breach.

I think that is unlikely. The Adobe breach data looked like this: 84557956-|--|-[redacted]@parponline.org-|-0tlHzKbr18uO6Wu5iaXtPQ==-|-mother's maiden name-Wilson|-- These logins are targeted at usernames. Adobe data didn't contain usernames, hence I don't understand how the Adobe data could help here. user.failed_login actor actor_ip 201.20.72.120 created_at 2013-11-18 21:03:47 note From GitHub.com user

You can login to github using an e-mail address.