Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

Post reply on HN
Print view View original

261–270 of 317 posts

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#261

Post by frenchtoast8 »

The repository is back online, with this explanation from the developer:

> This attack appears to have been conducted from a PAT token linked to @tj-actions-bot account to which "GitHub is not able to determine how this PAT was compromised."

> Account Security Enhancements

> * The password for the tj-actions-bot account has been updated.

> * Authentication has been upgraded to use a passkey for enhanced security.

> * The tj-actions-bot account role has been updated to ensure it has only the minimum necessary permissions.

> * GitHub proactively revoked the compromised Personal Access Token (PAT) and flagged the organization to prevent further exploitation.

https://github.com/tj-actions/changed-files/issues/2464#issu...

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#262

Post by theamk »

ptx wrote: post #242
ashishb wrote: post #39

Earlier quoted context omitted.

> Can you really say you trust all of these? We need better capabilities. E.g. when I run `fd`, `rg` or similar such tool, why should it have Internet access? IMHO, just eliminating Internet access for all tools (e.g. in a power mode), might fix this. The second problem is that we have merged CI and CD. The production/release tokens should ideally not be on the same system as the ones doing regular CI. More users nee…

FreeBSD has Capsicum [0] for this. Once a process enters capability mode, it can't do anything except by using already opened file descriptors. It can't spawn subprocesses, connect to the network, load kernel modules or anything else. To help with things that can't be done in the sandbox, e.g. DNS lookups and opening new files, it provides the libcasper library which implements them using helper processes. Not all ut…

I don't think it would help in this case, when the entire process can be replaced with malicious version. It just won't make the Capscium call.

What you really want is something external and easily inspectable, such as systemd per-service security rules, or flatpak sandboxing. Not sure if FreeBSD has somethingike this.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#263

Post by magicalhippo »

imoreno wrote: post #251
lenkite wrote: post #163

Earlier quoted context omitted.

This is why I have begin to prefer languages with comprehensive, batteries-included standard libraries so that you need very few dependencies. Dep Management has become a full time headache nowadays with significant effort going into CVE analysis.

Instead of bloating the base language for this, a trusted entity could simply fork those libraries, vet them, and repackage into some "blessed lib" that people like you can use in peace. In fact, the level of trust needed to develop safe libraries is less than developing language features.

That's basically what Boost[1] brought to C++.

[1]: https://www.boost.org/

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#264

Post by [deleted] »

kurmiashish wrote: post #253

Due to the ongoing security incident involving the tj-actions/changed-files Action, we at StepSecurity have provided a secure, drop-in replacement: step-security/changed-files. We strongly advise replacing all instances of tj-actions/changed-files in your workflows with our secure alternative: https://github.com/step-security/changed-files

[deleted]

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#265

Post by joonas »

kurmiashish wrote: post #253

Due to the ongoing security incident involving the tj-actions/changed-files Action, we at StepSecurity have provided a secure, drop-in replacement: step-security/changed-files. We strongly advise replacing all instances of tj-actions/changed-files in your workflows with our secure alternative: https://github.com/step-security/changed-files

Kudos for making this freely available, I was initially delighted to find out that there was a StepSecurity maintained alternative for the dorny/paths-filter action[1] as that seemed like a reasonable alternative to migrate to, but ended up being disappointed once I realized that it requires a subscription to use[2]

[1]: https://github.com/step-security/paths-filter [2]: https://github.com/step-security/paths-filter/blob/b251c10d0...

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#266

Post by marsovo »

BlackFingolfin wrote: post #250
marsovo wrote: post #230

Earlier quoted context omitted.

I don't think that's exactly what happened here: the compromise created new tags but generally the tag consumption relies on semantic versioning In other words: you specify version 44, the attacker creates 44.1, you're still hosed.

No you literally can (and the attackers did) change version 44 (the tag for it) to point to a different compromised commmit

Yes, you're right. I wasn't able to double-check as the repo was deleted at the time. That said, AIUI making the tags read-only would still often be vulnerable to semantic-version exploitation.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#267

Post by imglorp »

thinkplay11 wrote: post #197
imglorp wrote: post #192

Anybody have a snapshot of the good one, or maybe a drop in replacement? The repo is gone now.

Yup this would be super useful. Scouring about now trying to find

This looks like it's three years old but it's a start.

https://github.com/actions-marketplace-validations/tj-action...

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#268

Post by [deleted] »

joonas wrote: post #265
kurmiashish wrote: post #253

Due to the ongoing security incident involving the tj-actions/changed-files Action, we at StepSecurity have provided a secure, drop-in replacement: step-security/changed-files. We strongly advise replacing all instances of tj-actions/changed-files in your workflows with our secure alternative: https://github.com/step-security/changed-files

Kudos for making this freely available, I was initially delighted to find out that there was a StepSecurity maintained alternative for the dorny/paths-filter action[1] as that seemed like a reasonable alternative to migrate to, but ended up being disappointed once I realized that it requires a subscription to use[2] [1]: https://github.com/step-security/paths-filter [2]: https://github.com/step-security/paths-filter/…

[deleted]

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#269

Post by rahulr0609 »

kurmiashish wrote: post #253

Due to the ongoing security incident involving the tj-actions/changed-files Action, we at StepSecurity have provided a secure, drop-in replacement: step-security/changed-files. We strongly advise replacing all instances of tj-actions/changed-files in your workflows with our secure alternative: https://github.com/step-security/changed-files

@kurmiashish - If you and team are willing share your version without requiring a Step Security subscription today or in the future, happy to archive our repo and redirect users to Step

Thanks again for your timely detection and reporting!

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#270

Post by 0rzech »

remram wrote: post #50
harrisi wrote: post #41

It's always been shocking to me that the way people run CI/CD is just listing a random repository on GitHub. I know they're auditable and you pin versions, but it's crazy to me that the recommended way to ssh to a server is to just give a random package from a random GitHub user your ssh keys, for example. This is especially problematic with the rise of LLMs, I think. It's the kind of common task which is annoying en…

People don't pin versions. Referencing a tag is not pinning a version, those can be updated, and they are even with the official actions from GitHub.

Some people do actually pin versions, like me. For instance:

  - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
or

  - uses: subosito/flutter-action@f2c4f6686ca8e8d6e6d0f28410eeef506ed66aff # v2.18.0
It's a bit more manual work, but lepiej dmuchać na zimne (lit. it is better to blow on something cold), as the Polish proverb says.
Post reply on HN