Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

121–130 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#121

Post by LtWorf »

stavros wrote: post #111
siwatanejo wrote: post #93

Earlier quoted context omitted.

It's normal that a dev has *access* to all the code. But did he clone all the repos into his machine? I doubt it. So, the hacker extracted all the 3800 repos using the employee's machine as a gateway? I doubt it as well, I'm sure they would have detected this huge amount of data much earlier than transferring all of it? > The real question is why github has 3800 internal repos. I guess they mean customer's private re…

All the attackers need to do is steal an SSH key and they'd be able to clone everything, no?

Depends how it's set up. Many companies add an IP address check so if you don't come via their VPN (or are not in the office) the connection will be rejected before any auth is asked.

So you'd need to authenticate for the VPN, which often has 2nd factor.

But I have no idea of how they are set up.

Re: GitHub is investigating unauthorized access to their internal repositories

#122

Post by timmb »

siwatanejo wrote: post #107
selcuka wrote: post #95

Earlier quoted context omitted.

> I guess they mean customer's private repos? I don't think so. It is even worse if a random developer has access to customers' private repos.

Good point. Then why in the world would a company have 3,500 repos? Do they create a repo for each employee?

They’ve been developing git and GitHub for over a decade. It really isn’t surprising they have made thousands of internally available repos. They probably have hundreds just for running automated tests alone.

Re: GitHub is investigating unauthorized access to their internal repositories

#123

Post by fernie »

stavros wrote: post #111
siwatanejo wrote: post #93

Earlier quoted context omitted.

It's normal that a dev has *access* to all the code. But did he clone all the repos into his machine? I doubt it. So, the hacker extracted all the 3800 repos using the employee's machine as a gateway? I doubt it as well, I'm sure they would have detected this huge amount of data much earlier than transferring all of it? > The real question is why github has 3800 internal repos. I guess they mean customer's private re…

All the attackers need to do is steal an SSH key and they'd be able to clone everything, no?

Nah GitHub/MS doesn't allow SSH keys for their internal stuff. You have to use git-credential-manager, which enforces MFA

Re: GitHub is investigating unauthorized access to their internal repositories

#124

Post by chii »

lynndotpy wrote: post #64
tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view…

[flagged]

Re: GitHub is investigating unauthorized access to their internal repositories

#126

Post by ytoawwhra92 »

jameson wrote: post #94
lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

Security is often overlooked internally and seen as source of friction. I worked at a popular US social media firm and it wasn't hard to get a permission that allows me to delete the entire company's dataset. Often arguments around "I'm working on org-level initiative and I need to get permission to get it done" would easily get me the permission.

It _is_ a source of friction.

I can think of _one_ product that allows you to set up low-friction access management, and AFAIK most users of that product don't set it up that way.

Software engineers _should_ be able to request access to dev resources JIT during their day-to-day work, have that access auto-approve in >99% of cases, have it auto-expire if they don't actually use the resources, and have all of that be subject to anomaly detection/approval escalations and other auditing.

Instead in most orgs it's like fill out a form, get your manager (who's always in meetings) to approve and then wait some number of days for a human to click-ops your request. At best you can open a PR and have the changes applied in an hour or two.

You _should_ be able to get access to things pretty much immediately if you need them and they're not sensitive. Then we could deny by default without cratering productivity.

Re: GitHub is investigating unauthorized access to their internal repositories

#127

Post by sph »

lynndotpy wrote: post #64
tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view…

Who the heck follows Github on Snapchat, TikTok, YouTube, Pinterest, Instagram, Reddit, Facebook, WeChat?

Wherever they posted, there’s at this time two articles on the Hacker News front page. Sounds like they have reached their audience.

Re: GitHub is investigating unauthorized access to their internal repositories

#128

Post by in_a_society »

jms703 wrote: post #103

Do they know what the attackers were after? Maybe they were just trying to help fix the availability problems.

This comment reminds me of a joke where the punchline is that a person is so poor that burglars break in to their house and leave money.

Similarly, I could see ransomware groups hacking in and feeling bad for GH so they improve a few things to help them get to at leave nine fives of uptime.

Re: GitHub is investigating unauthorized access to their internal repositories

#129

Post by mlyle »

__turbobrew__ wrote: post #88
lorenzohess wrote: post #78

Why did one developer have access, even if read-only, to more than 3,800 internal repos?

I think it is pretty common that devs have read only access to all source code. The real question is why github has 3800 internal repos.

Shoot dude, the engineering organization I mentor/teach at a high school has ~75 internal repos.

Robot source code; satellite ground station hardware; satellite ground station software; visualization; satellite hardware; satellite software; nuttx + its submodules for 2 different projects; linux kernel fork; circuitpython fork; raspberry pico tools fork; embedded programming/debugging tools; my lecture notes; my automated grading tooling; etc etc etc. That's just me + ~35 students in classes.

Pretty easy to see how when you have scale you can get to a few thousand.

Re: GitHub is investigating unauthorized access to their internal repositories

#130

Post by sph »

uzyn wrote: post #18

The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like. I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an obser…

Are you from 2015? Companies have been announcing stuff on Twitter for a decade, and the rest of social media has been regurgitating Twitter posts for almost as long. Newspapers routinely quote Twitter. All that happened before they even renamed it to X.

I’m not saying it’s a good idea. I am saying it somehow became the single source of truth for the Internet with all that entails.

Post reply on HN