Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghrc.io appears to be malicious

bmitch.net

Post reply on HN
Print view View original

11–20 of 78 posts

Re: Ghrc.io appears to be malicious

#11

Post by echelon »

nicce wrote: post #9

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft.

Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

Re: Ghrc.io appears to be malicious

#12

Post by jsheard »

echelon wrote: post #11
nicce wrote: post #9

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

Microsoft is paying top dollar for MarkMonitor, aren't they supposed to proactively register obvious typos so this kind of thing doesn't happen to their clients?

Re: Ghrc.io appears to be malicious

#14

Post by Gigachad »

echelon wrote: post #10
arjvik wrote: post #2

Took the article pointing out that the c and r were transposed for me to even notice there was a problem!

The problem here is GitHub's terrible domain name. The container registry has a horrible name.

Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.

Re: Ghrc.io appears to be malicious

#15

Post by [deleted] »

engcoach wrote: post #7

Is the danger here token replay? It's using Bearer tokens, so it's not sending a password over: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Aut... > Threats section for Bearer tokens: https://datatracker.ietf.org/doc/html/rfc6750#section-5.2 > Does OAuth reuse tokens across domains? If not, doesn't this just mean it is requesting an auth token for ghrc (the "fake" domain) but it can't access any auth tok…

[deleted]

Re: Ghrc.io appears to be malicious

#16

Post by zx8080 »

Gigachad wrote: post #14
echelon wrote: post #10

Earlier quoted context omitted.

The problem here is GitHub's terrible domain name. The container registry has a horrible name.

Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.

Probably, it's cool, and honored inside an org to operate a separate domain service vs go ask for a permission for a subdomain to another team.

Re: Ghrc.io appears to be malicious

#17

Post by bmitch3020 »

engcoach wrote: post #7

Is the danger here token replay? It's using Bearer tokens, so it's not sending a password over: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Aut... > Threats section for Bearer tokens: https://datatracker.ietf.org/doc/html/rfc6750#section-5.2 > Does OAuth reuse tokens across domains? If not, doesn't this just mean it is requesting an auth token for ghrc (the "fake" domain) but it can't access any auth tok…

Blog author (and OCI maintainer) here. The request to get a bearer token sends the password or PAT using the basic auth header, base64 encoded, but otherwise clear-text. That's the request the www-authenticate header is triggering. Once the token is received, the registry uses that to verify access, and that eventually expires. But the attacker isn't getting the token, they are requesting the credentials that would be used to acquire a bearer auth token.

Re: Ghrc.io appears to be malicious

#18

Post by JdeBP »

Gigachad wrote: post #14
echelon wrote: post #10

Earlier quoted context omitted.

The problem here is GitHub's terrible domain name. The container registry has a horrible name.

Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.

Interestingly, the GitHub doco says outright that it superseded docker.pkg.github.com. ; so it was a conscious choice to go with this domain naming scheme instead of that one.

* https://docs.github.com/en/packages/working-with-a-github-pa...

Re: Ghrc.io appears to be malicious

#19

Post by VoidWhisperer »

jsheard wrote: post #12
echelon wrote: post #11

Earlier quoted context omitted.

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

Microsoft is paying top dollar for MarkMonitor, aren't they supposed to proactively register obvious typos so this kind of thing doesn't happen to their clients?

My guess is that MarkMonitor is mainly used for their brand-relevant domains (microsoft, office 365, github (main site), etc), as opposed to one that a small subset of a small subset of their users of one service will use - I would imagine that microsoft likely owns hundreds of domain names and doesn't pay MarkMonitor to monitor every single one

Re: Ghrc.io appears to be malicious

#20

Post by rconti »

Gigachad wrote: post #14
echelon wrote: post #10

Earlier quoted context omitted.

The problem here is GitHub's terrible domain name. The container registry has a horrible name.

Why does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.

insecurity through obscurity
Post reply on HN