Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

Post reply on HN
Print view View original

271–280 of 317 posts

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#271

Post by 0rzech »

evntdrvn wrote: post #186
harrisi wrote: post #61

Earlier quoted context omitted.

You and someone else pointed this out. I only use GitHub-org actions, and I just thought that surely there would be a "one version to rule them all" type rule.. how else can you audit things? I've never seen anything recommending specifying a specific commit hash or anything for GitHub actions. It's always just v1, v2, etc.

it is documented as recommended here fwiw: https://docs.github.com/en/actions/security-for-github-actio...

This. Using tags is acceptable only for official GitHub actions, anything else should be pinned.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#272

Post by brokenpip3 »

0rzech wrote: post #270
remram wrote: post #50

Earlier quoted context omitted.

People don't pin versions. Referencing a tag is not pinning a version, those can be updated, and they are even with the official actions from GitHub.

Some people do actually pin versions, like me. For instance: - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7 or - uses: subosito/flutter-action@f2c4f6686ca8e8d6e6d0f28410eeef506ed66aff # v2.18.0 It's a bit more manual work, but lepiej dmuchać na zimne (lit. it is better to blow on something cold ), as the Polish proverb says.

>It's a bit more manual work

after this incident, I started pinning all my github workflows with hashes, like other folks here I guess :D But I quickly got tired of doing it manually so I put together this [0] quick and dirty script to handle it for me. It just updates all workflow files in a repo and can be also used as a pre-commit hook to catch any unpinned steps in the future. It’s nothing fancy (leveraging ls-remote), but it’s saved me some time, so I figured I’d share in case it helps someone else :)

[0] https://github.com/brokenpip3/pre-commit-hooks?tab=readme-ov...

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#273

Post by [deleted] »

frenchtoast8 wrote: post #261

The repository is back online, with this explanation from the developer: > This attack appears to have been conducted from a PAT token linked to @tj-actions-bot account to which "GitHub is not able to determine how this PAT was compromised." > Account Security Enhancements > * The password for the tj-actions-bot account has been updated. > * Authentication has been upgraded to use a passkey for enhanced security. > *…

[deleted]

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#274

Post by HALtheWise »

deathanatos wrote: post #244

I've said this before, but in my mind the central problem in supply chain issues is this. Choose one: 1. You fix what version you're using to a fixed, immutable package. You receive no updates, no bug fixes, no security patches. 2. You follow a pointer to something like a API-compatible version, "latest" (#yolo) or ^5.0.0. You get bug fixes, security patches, but someone can push malicious updates. Security types, IM…

It seems like a 24hr delay for auto upgrades would mitigate a lot of this, maybe with some way that a trusted third-party could skip the delay for big-ticket zero day patches?

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#275

Post by kurmiashish »

rahulr0609 wrote: post #269
kurmiashish wrote: post #253

Due to the ongoing security incident involving the tj-actions/changed-files Action, we at StepSecurity have provided a secure, drop-in replacement: step-security/changed-files. We strongly advise replacing all instances of tj-actions/changed-files in your workflows with our secure alternative: https://github.com/step-security/changed-files

@kurmiashish - If you and team are willing share your version without requiring a Step Security subscription today or in the future, happy to archive our repo and redirect users to Step Thanks again for your timely detection and reporting!

@rahulr0609 https://github.com/step-security/changed-files will forever remain free, and the community can use it without requiring a StepSecurity subscription.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#276

Post by frenchtoast8 »

frenchtoast8 wrote: post #261

The repository is back online, with this explanation from the developer: > This attack appears to have been conducted from a PAT token linked to @tj-actions-bot account to which "GitHub is not able to determine how this PAT was compromised." > Account Security Enhancements > * The password for the tj-actions-bot account has been updated. > * Authentication has been upgraded to use a passkey for enhanced security. > *…

Editing to add: the developer has locked further discussion about this. Very concerning as I believe their explanations are raising more questions than they are answering.

First of all, clearly Github can't answer for the developer how their bot's token was compromised, that's something the developer needs to find out. Instead they are repeating this statement like it's out of their hands.

But more concerningly, I don't believe the explanation is supported by the Github history which says the compromised commit was "authored" by Renovate and "pushed" by @jackton1. It's obvious how the first part was spoofed, but the second part is concerning as it indicates the @jackton1 account was compromised not @tj-actions-bot. If I'm missing something please let me know.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#277

Post by thj4742 »

frenchtoast8 wrote: post #276
frenchtoast8 wrote: post #261

The repository is back online, with this explanation from the developer: > This attack appears to have been conducted from a PAT token linked to @tj-actions-bot account to which "GitHub is not able to determine how this PAT was compromised." > Account Security Enhancements > * The password for the tj-actions-bot account has been updated. > * Authentication has been upgraded to use a passkey for enhanced security. > *…

Editing to add: the developer has locked further discussion about this. Very concerning as I believe their explanations are raising more questions than they are answering. First of all, clearly Github can't answer for the developer how their bot's token was compromised, that's something the developer needs to find out. Instead they are repeating this statement like it's out of their hands. But more concerningly, I do…

Check the timestamp on that commit push. It was from today, an hour or two before the repo was restored, not yesterday when the attack happened. The push actor != the committor or even the actual commit author, and there can be multiple push actors if the commit is pushed multiple times by different actors.

He probably just re-pushed the bad commit while trying to figure out how to fix this.

I find it very plausible that the bot token was compromised, not his user account token, as the attack was simply to push over the tags (which is something the automation bot would have access to do, as tag management is one of its functions)

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#278

Post by jamesberthoty »

thj4742 wrote: post #277
frenchtoast8 wrote: post #276

Earlier quoted context omitted.

Editing to add: the developer has locked further discussion about this. Very concerning as I believe their explanations are raising more questions than they are answering. First of all, clearly Github can't answer for the developer how their bot's token was compromised, that's something the developer needs to find out. Instead they are repeating this statement like it's out of their hands. But more concerningly, I do…

Check the timestamp on that commit push. It was from today, an hour or two before the repo was restored, not yesterday when the attack happened. The push actor != the committor or even the actual commit author, and there can be multiple push actors if the commit is pushed multiple times by different actors. He probably just re-pushed the bad commit while trying to figure out how to fix this. I find it very plausible…

Does this seem like a plausible summary?

1. tj-actions-bot PAT spoofs renovatebot commit with malicious code - probably by creating a new unprotected branch, pushing to it spoofing the renovatebot user, then deleting the branch, but we really don't know.

2. Attacker uses PAT to also update release tags, pointing them to the malicious commit, again spoofing renovatebot

3. jackton1 tries to restore older branch, and therefore pushes the commit again. The original commit wouldn't be referenced as pushed in any pull requests

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#279

Post by thj4742 »

jamesberthoty wrote: post #278
thj4742 wrote: post #277

Earlier quoted context omitted.

Check the timestamp on that commit push. It was from today, an hour or two before the repo was restored, not yesterday when the attack happened. The push actor != the committor or even the actual commit author, and there can be multiple push actors if the commit is pushed multiple times by different actors. He probably just re-pushed the bad commit while trying to figure out how to fix this. I find it very plausible…

Does this seem like a plausible summary? 1. tj-actions-bot PAT spoofs renovatebot commit with malicious code - probably by creating a new unprotected branch, pushing to it spoofing the renovatebot user, then deleting the branch, but we really don't know. 2. Attacker uses PAT to also update release tags, pointing them to the malicious commit, again spoofing renovatebot 3. jackton1 tries to restore older branch, and th…

For #3: You don’t have to actually have a commit in a pull request for it to show up in the PR “conversation”. Simply putting the PR # in the commit message like #2460 would result in it showing up like that (“commit referenced this pull request”). The original malicious commit copied a real PR merge commit with #2460, so anyone who pushed it in this repo to any branch would have their push referenced in the PR conversation list. It’s just a misleading UI in my opinion.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#280

Post by juliob »

ronjouch wrote: post #178
mubou wrote: post #129

Earlier quoted context omitted.

This is why I fork the extensions I use, with the exception of uBlock. Basically just copy the extension folder, if I can't find it on GitHub. That way I can audit the code and not have to worry about an auto-update sneaking in something nefarious. I've had two extensions in the past suddenly start asking for permissions they definitely did not need, and I suspect this is why. Btw, here's a site where you can inspect…

Yeah, and thx for the link to the neat crx explorer. Close to what you do, I started writing my own addon to replace a couple addons whose featureset I use only partially. For example, when I use Chromium I want 1. to customize the New Tab page, and 2. to add a keyboard shortcut to pin/unpinTab. These two features are absolutely part of extensions, but in addition to the security risk I find them heavy (I don’t need…

You shouldn’t need an extension just to add a keyboard shortcut for a menu item. Doesn’t your OS let you map that? On macOS you can in Keyboard Settings
Post reply on HN