Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious code added to 35k GitHub repos, leaking user environments

twitter.com

Post reply on HN
Print view View original

51–60 of 79 posts

Re: Malicious code added to 35k GitHub repos, leaking user environments

#51

Post by vishnugupta »

skrebbel wrote: post #28
jwilk wrote: post #12

> So far found in projects including: crypto, golang, python, js, bash, docker, k8s Huh? What does that mean?

The author is being obtuse. They mean that clones have been made of those projects that include malicious code. It's like if I make a copy of the New York Times website but replace the cover image with nudity and put it on a different URL and someone tweets "omg NYT has nudity on the front page" and clarifies, vaguely, 10 tweets down that it was actually not the real NYT but a clone. I'm not convinced that the author…

This should be the top comment on this thread.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#52

Post by eurasiantiger »

laserlight wrote: post #46
stevelacy wrote: post #5

Earlier quoted context omitted.

Many of the repos I found were clones of valid projects with same names under new orgs and new users. For instance, this projects is valid: https://github.com/scala-network/GUI-miner and it's infected clone: https://github.com/stellitecoin/gui-miner GPG signed commits by the legitimate users do not contain the malware

Considering that only clones are affected, your original tweet is downright wrong. None of the listed projects (python, js, bash, docker, k8s) are affected. Anybody can fork a repository to introduce malware.

js is a project?

Re: Malicious code added to 35k GitHub repos, leaking user environments

#54

Post by oefrha »

soruly wrote: post #24

note that it's 35,613 code results, not 35k repos and 13K of the search results come from this org https://github.com/redhat-operator-ecosystem

And these aren't compromised projects, they are repos created by the "attacker" if you can even call them that. Of course anyone can push malware to their own account. The author admits this in the thread:

> The attacker creates FAKE orgs/repos and pushes clones of LEGIT projects to github.

Pure scaremongering and/or attention seeking.

Edit: Sorry, I posted two similar comments because my first top level one was immediately downvoted to the bottom. It has since come back up.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#55

Post by irjustin »

stevelacy wrote: post #13
irjustin wrote: post #11

Earlier quoted context omitted.

How does this solution solve the problem? You're just adding an extra step that's hardly going to stop someone.

It would only allow commits signed by me to be pushed under my email. Github uses the email as the "proof" of commit ownership. By only accepting signed commits a user would not be able to push a commit impersonating me.

That solves impersonation, but that is not a related problem here.

These repos were not taken over but cloned and made to look like another repo via similar naming.

I think what you're looking for is more "all accounts must be verified via payment/identity" then you really know who is making "random clones" and "look-a-likes" w/ malware.

But you've got a whole host of other problems in the process.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#56

Post by yorwba »

oefrha wrote: post #48

What a garbage clickbait thread. From scary words like "attack", "infected", etc. you would think projects are compromised. But nothing is compromised. From wayyyyy down in the thread: > The attacker creates FAKE orgs/repos and pushes clones of LEGIT projects to github. Yeah, anyone can push anything to their own GitHub accounts/orgs, including malware. We know that. Save yourself some time. Flagged.

https://news.ycombinator.com/newsguidelines.html

> If you flag, please don't also comment that you did.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#57

Post by abctree »

This is a consequence of centralization. The canonical project sites and repositories should not be on GitHub.

Fanatics who believe otherwise will still clone those projects so that they are on sacred ground, but the practice should be frowned upon and fought against.

Another detrimental effect of GitHub is that they have trained users to accept public "forks" (a misnomer) as the usual way to contribute even trivial patches. This lowers the bar for accepting and trusting non-official repositories.

GitHub has devalued the brand of large projects and has introduced the age of industrialized software development by creating an addictive environment where software politicians thrive by manipulating their social networks and working on their personal brand.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#58

Post by NuclearFishin »

oefrha wrote: post #48

What a garbage clickbait thread. From scary words like "attack", "infected", etc. you would think projects are compromised. But nothing is compromised. From wayyyyy down in the thread: > The attacker creates FAKE orgs/repos and pushes clones of LEGIT projects to github. Yeah, anyone can push anything to their own GitHub accounts/orgs, including malware. We know that. Save yourself some time. Flagged.

The risk here is that somebody might download the fake repo mistaking it for the real one

Re: Malicious code added to 35k GitHub repos, leaking user environments

#59

Post by raggi »

oefrha wrote: post #48

What a garbage clickbait thread. From scary words like "attack", "infected", etc. you would think projects are compromised. But nothing is compromised. From wayyyyy down in the thread: > The attacker creates FAKE orgs/repos and pushes clones of LEGIT projects to github. Yeah, anyone can push anything to their own GitHub accounts/orgs, including malware. We know that. Save yourself some time. Flagged.

From what I can see, he wrote the tweet after organically finding one of these via Google and then searching and finding that there were many many more.

It's absolutely true that the wording is wrong, but I think it's reasonable to accept a jumped the gun rather than a clickbait explanation.

The presence of large volumes of project copies on typosquats and synonym squats is still a problem, they'll still get indexed by tools, and then the tools boost their page rank, and eventually some make it to users. Given that the Go init payload contains an RCE and not just a data collection, there is still something of note there. Yes it's not 35k compromised projects, but it is a broad deployment of malicious code.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#60

Post by mudrockbestgirl »

abctree wrote: post #57

This is a consequence of centralization. The canonical project sites and repositories should not be on GitHub. Fanatics who believe otherwise will still clone those projects so that they are on sacred ground, but the practice should be frowned upon and fought against. Another detrimental effect of GitHub is that they have trained users to accept public "forks" (a misnomer) as the usual way to contribute even trivial…

I'm upvoting just for the hot take.
Post reply on HN