Ghrc.io appears to be malicious
bmitch.net
Ghrc.io appears to be malicious
1–10 of 78 posts
Re: Ghrc.io appears to be malicious
#2Took the article pointing out that the c and r were transposed for me to even notice there was a problem!
Re: Ghrc.io appears to be malicious
#3Fairly compelling attack vector because it took several readings for me to even see the problem with the domain.
Re: Ghrc.io appears to be malicious
#4Took the article pointing out that the c and r were transposed for me to even notice there was a problem!
Yep this is the sort of typo error I make probably 10 times a day.
Re: Ghrc.io appears to be malicious
#5Damn, this can pick a typo from a CI job and do mean things.
Re: Ghrc.io appears to be malicious
#6There are alot of open source projects using this domain https://github.com/search?q=ghrc.io&type=code
Re: Ghrc.io appears to be malicious
#7Is the danger here token replay? It's using Bearer tokens, so it's not sending a password over:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Aut...>
Threats section for Bearer tokens: https://datatracker.ietf.org/doc/html/rfc6750#section-5.2>
Does OAuth reuse tokens across domains? If not, doesn't this just mean it is requesting an auth token for ghrc (the "fake" domain) but it can't access any auth tokens for ghcr (the real domain)?
Re: Ghrc.io appears to be malicious
#8Re: Ghrc.io appears to be malicious
#9GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous.
[1] https://docs.github.com/en/packages/working-with-a-github-pa...
Edit: most relevant issues?
Re: Ghrc.io appears to be malicious
#10Took the article pointing out that the c and r were transposed for me to even notice there was a problem!
The problem here is GitHub's terrible domain name.
The container registry has a horrible name.