Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github seems to be experiencing security issues

github.com

Post reply on HN
Print view View original

21–30 of 59 posts

Re: Github seems to be experiencing security issues

#21

Post by NKCSS »

aram wrote: post #5

Very strange; I just checked my security history and see that there have been 5 unsuccessful login attempts from China/Venezuela to my account (last 14 hours). Everything before that is pretty clean and without fake logins. Does anyone have more information on this?

Same here,

   user.failed_login: Originated from 186.93.130.3 9 hours ago
   user.failed_login: Originated from 186.94.122.201 13 hours ago
   user.failed_login: Originated from 201.242.68.112 17 hours ago 
   user.failed_login: Originated from 190.200.21.131 a day ago 
   user.failed_login: Originated from 190.73.250.152 2 days ago

Re: Github seems to be experiencing security issues

#22

Post by aniketpant »

Here are my logs from the last two days:

user.failed_login

actor_ip 186.93.156.104

created_at 2013-11-18 14:45:30

---

user.failed_login

actor_ip 180.183.84.109

created_at 2013-11-18 06:05:01

---

user.failed_login

actor_ip 41.79.65.109

created_at 2013-11-17 12:55:31

---

user.failed_login

actor_ip 186.93.79.118

created_at 2013-11-17 12:40:34

Re: Github seems to be experiencing security issues

#23

Post by 1qaz2wsx3edc »

wgx wrote: post #13

The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts. As anyone who's put an EC2 up without secu…

Attacks like this are common place on the internet.

What I will take away from this, is that github provides a very nice authentication audit log. I really want every service/app/site to provide this kind of information.

Re: Github seems to be experiencing security issues

#26

Post by anonymoushn »

junto wrote: post #18
simonw wrote: post #16

I wonder if these failed login attempts are using passwords from the Adobe breach.

I think that is unlikely. The Adobe breach data looked like this: 84557956-|--|-[redacted]@parponline.org-|-0tlHzKbr18uO6Wu5iaXtPQ==-|-mother's maiden name-Wilson|-- These logins are targeted at usernames. Adobe data didn't contain usernames, hence I don't understand how the Adobe data could help here. user.failed_login actor actor_ip 201.20.72.120 created_at 2013-11-18 21:03:47 note From GitHub.com user

Github users frequently have public email addresses or email addresses on their commits. It is also reasonable to try to match $foo@domain.com with the username $foo.

Re: Github seems to be experiencing security issues

#27

Post by thezilch »

Strangely, I use a unique email for github, like I do with most sites that allow attaching "+comment" to the localpart of email addresses. Are attackers really this sophisticated, or where did they get the list?

Edit: Nevermind, I guess github allows authenticating with a username, in addition to the email.

Re: Github seems to be experiencing security issues

#29

Post by awjr »

awjr wrote: post #25

I would strongly suggest people enable two factor authentication: https://github.com/settings/two_factor_authentication/config...

Just one foot note (as I have just taken my own advice and turned it on). Suddenly I couldn't push/pull through the git command line access as it would not accept my password.

Took me a bit to work it out but you need to go here https://github.com/settings/applications and create personal access tokens.

Post reply on HN