Repositories held for ransom by using valid credentials
about.gitlab.com
Repositories held for ransom by using valid credentials
1–10 of 158 posts
Re: Repositories held for ransom by using valid credentials
#2The title on HN is clickbait, the article mentions Gitlab users storing their own Gitlab password/tokens insecurely. It doesn't look like "Gitlab was compromised" to me.
The original title is "Critical security announcement: Suspicious git activity detected".
Re: Repositories held for ransom by using valid credentials
#3Gitlab was NOT compromised. Someone found passwords/tokens for Gitlab repositories exposed on the internet and held them for ransom.
Re: Repositories held for ransom by using valid credentials
#4"Gitlab.com was compromised" is a bad title. _Accounts on_ GitLab, and the credentials to access them, were compromised, but the title suggests that the whole platform was affected, which doesn't seem to be the case.
Re: Repositories held for ransom by using valid credentials
#5> We believe that no data has been lost, unless the owner/maintainer of the repository did not have a local copy and the GitLab copy was the only one.
Too bad they don't make backups of users repositories?
Re: Repositories held for ransom by using valid credentials
#6The current title "Gitlab.com Was Compromised" doesn't seem accurate. There's someone (or a group) currently attacking online repositories (gitlab is not the only affected provider) using passwords found in scans for files like .gitconfig's and the like. Unless new information comes to light about gitlab specifically being compromised, I'd say this is more about individual private repos being on the sights of a targetted attack.
Re: Repositories held for ransom by using valid credentials
#7A bit of a misleading headline. Somebody had passwords/tokens for certain repos, either from previous breaches at other services or those passwords being stored in plaintext as part of a deployment.
Re: Repositories held for ransom by using valid credentials
#8> We believe that no data has been lost, unless the owner/maintainer of the repository did not have a local copy and the GitLab copy was the only one. Too bad they don't make backups of users repositories?
GitLab is not a repository backup service. They are only required to hold multiple copies of what is the current version of the repository for their own hard drive fault tolerance purposes; they are not required to hold copies of the repository from a day, week, month, or year ago.
Re: Repositories held for ransom by using valid credentials
#9> We believe that no data has been lost, unless the owner/maintainer of the repository did not have a local copy and the GitLab copy was the only one. Too bad they don't make backups of users repositories?
GitLab is not a repository backup service. They are only required to hold multiple copies of what is the current version of the repository for their own hard drive fault tolerance purposes; they are not required to hold copies of the repository from a day, week, month, or year ago.
Was just a question, don't get me wrong here. Thought they would do this for their managed service.
Re: Repositories held for ransom by using valid credentials
#10>The breaches seem to rely on the attacker having knowledge of the affected users passwords in order to wipe their Git repositories and hold them for ransom.
Yeah, until I go to my computer and use "git push" again. No?
Also gitsbackup.com is registered but has no A/MX records so...