Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

trigger.dev

Post reply on HN
Print view View original

41–50 of 191 posts

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#41

Post by 0xbadcafebee »

zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

1) Get 1Password, 2) use 1Password to hold all your SSH keys and authorize SSH access [1], 3) use 1Password to sign your Git commits and set up your remote VCS to validate them [2], 4) use GitHub OAuth [3] or the GitHub CLI's Login with HTTPS [4] to do repository push/pull. If you don't like 1Password, use BitWarden.

With this setup there are two different SSH keys, one for access to GitHub, one is a commit signing key, but you don't use either to push/pull to GitHub, you use OAuth (over HTTPS). This combination provides the most security (without hardware tokens) and 1Password and the OAuth apps make it seamless.

Do not use a user with admin credentials for day to day tasks, make that a separate user in 1Password. This way if your regular account gets compromised the attacker will not have admin credentials.

[1] https://developer.1password.com/docs/ssh/agent/ [2] https://developer.1password.com/docs/ssh/git-commit-signing/ [3] https://github.com/hickford/git-credential-oauth [4] https://cli.github.com/manual/gh_auth_login

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#42

Post by 0xbadcafebee »

nottorp wrote: post #40
otterley wrote: post #39

Earlier quoted context omitted.

Your SSH private key must be encrypted using a passphrase. Never store your private key in the clear!

And what do you do with the passphrase, store it encrypted with a passphrase?

You memorize it, or keep it in 1Password. 1Password can manage your SSH keys, and 1Password can/does require a password, so it's still protected with something you know + something you have.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#44

Post by fwip »

nottorp wrote: post #40
otterley wrote: post #39

Earlier quoted context omitted.

Your SSH private key must be encrypted using a passphrase. Never store your private key in the clear!

And what do you do with the passphrase, store it encrypted with a passphrase?

One option is to remember it.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#45

Post by otterley »

nottorp wrote: post #40
otterley wrote: post #39

Earlier quoted context omitted.

Your SSH private key must be encrypted using a passphrase. Never store your private key in the clear!

And what do you do with the passphrase, store it encrypted with a passphrase?

This is what agents are for. You load your private key into an agent so you don't have to enter your passphrase every time you use it. Agents are supposed to be hardened so that your private key can't be easily exfiltrated from them. You can then configure `ssh` to pass requests through the agent.

There are lots of agents out there, from the basic `ssh-agent`, to `ssh-agent` integrated with the MacOS keychain (which automatically unlocks when you log in), to 1Password (which is quite nice!).

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#46

Post by getnormality »

snickerbockers wrote: post #43
getnormality wrote: post #5

I am loving the ancient Lovecraftian horror vibe of these exploit names. Good for raising awareness, I guess!

Shai Hulud is the god that lives inside the sandworms in Dune.

Noted!

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#47

Post by snickerbockers »

zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

password-protect your key (preferably with a good password that is not the same password you use to log in to your account). If you use a password it's encrypted; otherwise its stored on plaintext and anybody who manages to get a hold of your laptop can steal the private key.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#48

Post by mr_mitm »

zozos wrote: post #3

I have been thinking about this. How do I make my git setup on my laptop secure? Currently, I have my ssh key on the laptop, so if I want to push, I just use git push. And I have admin credentials for the org. How do I make it more secure?

There is no defense against a compromised laptop. You should prevent this at all cost.

You can make it a bit more challenging for the attacker by using secure enclaves (like TPM or Yubikey), enforce signed commits, etc. but if someone compromised your machine, they can do whatever you can.

Enforcing signing off on commits by multiple people is probably your only bet. But if you have admin creds, an attacker can turn that off, too. So depending on your paranoia level and risk appetite, you need a dedicated machine for admin actions.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#49

Post by mr_mitm »

otterley wrote: post #45
nottorp wrote: post #40

Earlier quoted context omitted.

And what do you do with the passphrase, store it encrypted with a passphrase?

This is what agents are for. You load your private key into an agent so you don't have to enter your passphrase every time you use it. Agents are supposed to be hardened so that your private key can't be easily exfiltrated from them. You can then configure `ssh` to pass requests through the agent. There are lots of agents out there, from the basic `ssh-agent`, to `ssh-agent` integrated with the MacOS keychain (which…

This is a good defense for malware that only has read access to the filesystem or a stolen hard drive scenario without disk encryption, but does nothing against the compromised dev machine scenario.

Re: Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

#50

Post by nottorp »

fwip wrote: post #44
nottorp wrote: post #40

Earlier quoted context omitted.

And what do you do with the passphrase, store it encrypted with a passphrase?

One option is to remember it.

I don’t think that’s considered secure enough, see the other answers and the push for passkeys.

I mean, if passphrases were good for anything you’d directly use them for the ssh connection? :)

Post reply on HN