Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious code added to 35k GitHub repos, leaking user environments

twitter.com

Post reply on HN
Print view View original

71–79 of 79 posts

Re: Malicious code added to 35k GitHub repos, leaking user environments

#71

Post by gnomewascool »

oefrha wrote: post #48

What a garbage clickbait thread. From scary words like "attack", "infected", etc. you would think projects are compromised. But nothing is compromised. From wayyyyy down in the thread: > The attacker creates FAKE orgs/repos and pushes clones of LEGIT projects to github. Yeah, anyone can push anything to their own GitHub accounts/orgs, including malware. We know that. Save yourself some time. Flagged.

Yes, the scope is not "35k existing GitHub repos are infected", since AFAICT all the infected repos are forks, so the title is misleading.

However:

1. The scale is pretty worrying. Given the total number of repos on GitHub (> 100M) it's a drop in the ocean, but still huge.

2. Typo-squatting on, say, PyPI or npmjs is certainly note-worthy, and this is a very similar attack.

3. At least some of the infected forks had several stars, some from ~ 5 year old accounts, so apparently some people were using them.

4. The original Twitter thread did note that infected forks were being created — it just didn't emphasise that this was the only attack surface, probably because the author didn't realise.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#72

Post by denismi »

stevelacy wrote: post #8
drekipus wrote: post #7

This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?

Correct. My suggestion for a solution is for github to add a "reject-unsigned" feature. Only allow commits signed by and to be pushed to github, under any projects/org.

I lost a Yubikey, so I revoked the subkeys on it. Github didn't let me update the existing pubkey, so I had to remove and re-enter it. Now all things signed by the revoked key, despite being before the revoke date, come up as unverified.

I'm not sure if it's a me issue or a PGP issue or a GitHub issue, but it's a pretty broken system.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#73

Post by gary_0 »

NuclearFishin wrote: post #58
oefrha wrote: post #48

What a garbage clickbait thread. From scary words like "attack", "infected", etc. you would think projects are compromised. But nothing is compromised. From wayyyyy down in the thread: > The attacker creates FAKE orgs/repos and pushes clones of LEGIT projects to github. Yeah, anyone can push anything to their own GitHub accounts/orgs, including malware. We know that. Save yourself some time. Flagged.

The risk here is that somebody might download the fake repo mistaking it for the real one

Especially considering how easy it is for duplicate content to reach the top results on Google these days.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#74

Post by drekipus »

jollybean wrote: post #65
drekipus wrote: post #7

This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?

What is the difference between a 'random' and 'non random' repo? The whole point of 'Open Source' is that we can use code which might otherwise be a bit 'random'. It's not 'Institutionalized Open Source' it's just 'Open Source' i.e. we're not all Torvalds. So, credibility etc. is a very fickle thing otherwise, this is a serious security issue and we really don't have answers. We used to think about code as 'logic tha…

It's a good point actually.

I suppose the message is "read the code you're using" but that is hard for big libraries and frameworks.

Obviously using one's code where they are impersonating someone else is a big red flag.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#75

Post by macintux »

iforgotpassword wrote: post #25
macintux wrote: post #17

Earlier quoted context omitted.

This is also a problem for enterprises. I’ve seen commits from root, ec2-user, etc: GitHub knows who’s pushing a commit even if git doesn’t, and it’s maddening that at least for enterprise accounts they don’t carry that identity into the metadata.

That would change the commit hash, at least if you want it to survive a clone of the repo. Of you'd store it externally so that it would only be able to be shown in the webui then it's of limited use, but maybe better than nothing.

Specifically it could be exposed through the GitHub REST API without impacting the commit itself.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#76

Post by jwilk »

xrisk wrote: post #29
iforgotpassword wrote: post #25

Earlier quoted context omitted.

That would change the commit hash, at least if you want it to survive a clone of the repo. Of you'd store it externally so that it would only be able to be shown in the webui then it's of limited use, but maybe better than nothing.

I feel the commit data could be extended to include some metadata that isn’t used to compute the hash. GitHub could then make use of this data to populate whatever. (Not sure if such a field already exists in the commit blob)

I think you want git-notes (or something similar):

https://git-scm.com/docs/git-notes

"Adds, removes, or reads notes attached to objects, without touching the objects themselves."

Re: Malicious code added to 35k GitHub repos, leaking user environments

#77

Post by jollybean »

drekipus wrote: post #74
jollybean wrote: post #65

Earlier quoted context omitted.

What is the difference between a 'random' and 'non random' repo? The whole point of 'Open Source' is that we can use code which might otherwise be a bit 'random'. It's not 'Institutionalized Open Source' it's just 'Open Source' i.e. we're not all Torvalds. So, credibility etc. is a very fickle thing otherwise, this is a serious security issue and we really don't have answers. We used to think about code as 'logic tha…

It's a good point actually. I suppose the message is "read the code you're using" but that is hard for big libraries and frameworks. Obviously using one's code where they are impersonating someone else is a big red flag.

Reading the code for functional integrity is already a big deal, but having to sleuth around for the sneacky hacks? No way.

I don't know what the answer is, but the model has to be changed.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#78

Post by [deleted] »

jhugo wrote: post #38
eurasiantiger wrote: post #30

Earlier quoted context omitted.

And now we’re on the fast track to adopt a blockchain as a tamper evident mechanism.

git is effectively a blockchain. Trying to use a blockchain for this has many of the same problems as described in GP's comment.

[deleted]

Re: Malicious code added to 35k GitHub repos, leaking user environments

#79

Post by 3np »

jhugo wrote: post #38
eurasiantiger wrote: post #30

Earlier quoted context omitted.

And now we’re on the fast track to adopt a blockchain as a tamper evident mechanism.

git is effectively a blockchain. Trying to use a blockchain for this has many of the same problems as described in GP's comment.

A blockchain could be useful for proving a commit was not done significantly before or after the claimed timestamp, and (depending on how you do it) non-repudiation.

IMO I don't see how this is desirable enough to be worth it.

Wider adoption of GPG signatures would be much more impactful.

It could make sense to use a blockchain for key distribution/key discovery/revocation, effectively as a replacement of PKI, though.

Post reply on HN