Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Repositories held for ransom by using valid credentials

about.gitlab.com

Post reply on HN
Print view View original

21–30 of 158 posts

Re: Repositories held for ransom by using valid credentials

#21

Post by bigblind »

Boulth wrote: post #20
avar wrote: post #17

> We believe that no data has been lost, unless the [...] GitLab copy was the only one. One difference between how GitLab and GitHub run their infrastructure is that GitLab doesn't keep reflogs, and uses git's default "gc" settings. As a result they won't have the data in question anymore in many cases[1]. Well, I don't 100% know that for sure, but it's the default configuration of their software, and I'm assuming th…

Just out of curiosity but how do you know about this inner workings of Github and GitLab?

I don't know about GitHub, but GitLab has an open source distribution, so you can assume they use the same configuration internally.

Re: Repositories held for ransom by using valid credentials

#22

Post by ishitatsuyuki »

Boulth wrote: post #20
avar wrote: post #17

> We believe that no data has been lost, unless the [...] GitLab copy was the only one. One difference between how GitLab and GitHub run their infrastructure is that GitLab doesn't keep reflogs, and uses git's default "gc" settings. As a result they won't have the data in question anymore in many cases[1]. Well, I don't 100% know that for sure, but it's the default configuration of their software, and I'm assuming th…

Just out of curiosity but how do you know about this inner workings of Github and GitLab?

You can access unreachable refs by means of Pull Request force pushes; even if you force push, you can still view the state at the original commit given that you have the hash of that. That plus some internal knowing of Git allows the author to guess how GitHub works this way.

As on GitLab, it's open source, so you can easily check that.

Re: Repositories held for ransom by using valid credentials

#24

Post by Ayesh »

There was a Docker Hub breach a few days ago, that's probably related.

I took a good look at how my personal tokens were used in Github and Gitlab.

- Enable 2FA.

- Enable Commit signing with GPG. for the past 2-3 years, I have slowly moved to sign commits and tags. GPG keys take a log of hygiene to work with (sub keys, revocation, etc), but they definitely can help in a situation like.

Git is a distributed VCS. If you have a repo cloned in a secure location (your server, Dev machine, etc), that is just as good as your Gitlab/hub hosted copy.

Re: Repositories held for ransom by using valid credentials

#25

Post by masklinn »

avar wrote: post #17

> We believe that no data has been lost, unless the [...] GitLab copy was the only one. One difference between how GitLab and GitHub run their infrastructure is that GitLab doesn't keep reflogs, and uses git's default "gc" settings. As a result they won't have the data in question anymore in many cases[1]. Well, I don't 100% know that for sure, but it's the default configuration of their software, and I'm assuming th…

I'm surprised github runs regular git. I'd always assumed they were emulating it, especially with the lag we've observed between github-api and github-git at $DAYJOB (update repo 1 via api, update repo 2 via api, fetch repo 1 and repo 2 via git, we've had cases where the repo 2 update was visible but not the repo 1).

Re: Repositories held for ransom by using valid credentials

#26

Post by the_duke »

rmkrmk wrote: post #5

> We believe that no data has been lost, unless the owner/maintainer of the repository did not have a local copy and the GitLab copy was the only one. Too bad they don't make backups of users repositories?

They do infact create snapshots twice a day and keep them for two weeks.

https://about.gitlab.com/handbook/engineering/infrastructure...

Re: Repositories held for ransom by using valid credentials

#27

Post by the_duke »

avar wrote: post #17

> We believe that no data has been lost, unless the [...] GitLab copy was the only one. One difference between how GitLab and GitHub run their infrastructure is that GitLab doesn't keep reflogs, and uses git's default "gc" settings. As a result they won't have the data in question anymore in many cases[1]. Well, I don't 100% know that for sure, but it's the default configuration of their software, and I'm assuming th…

They do keep disk snapshots for 2 weeks though (created twice a day).

https://about.gitlab.com/handbook/engineering/infrastructure...

Re: Repositories held for ransom by using valid credentials

#28

Post by Operyl »

yoz-y wrote: post #16
1023bytes wrote: post #14

Some other info: https://www.theregister.co.uk/2019/05/03/git_ransomware_bitc...

Out of all things to hold for ransom git repos seem like a bad idea. Most of the time there are multiple clones lying around anyways. I agree that having the source code leak can be bad news, but the code itself being secret should not be a critical part of the business.

So you’re telling me that if, say, Google’s Search algorithm got leaked it wouldn’t seriously hinder their business? There’s definitely cases where leaking a business’ code can be pretty disastrous.
Post reply on HN