Hacked: commit to rails master on GitHub
github.com
Hacked: commit to rails master on GitHub
1–10 of 240 posts
Re: Hacked: commit to rails master on GitHub
#2I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.
Re: Hacked: commit to rails master on GitHub
#3I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.
I think it's a mass assignment vulnerability:
Re: Hacked: commit to rails master on GitHub
#4I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.
GitHub uses Rails. Depending on who you ask, either Rails is at fault for having unsafe defaults or GitHub is at fault for not reading the documentation. It just so happens that he demonstrated his point on the Rails repo because he thinks it's a failing of Rails, but it could have been any repo.
Re: Hacked: commit to rails master on GitHub
#5Here's the guy's blog post about the hack: http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.htm...
"Today I can pull/commit/push in any repository on github. Jack pot."
Re: Hacked: commit to rails master on GitHub
#6I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.
As Github is a Rails 2 app, I'm pretty sure it's a Rails (and therefore also Github) vulnerability.
Re: Hacked: commit to rails master on GitHub
#7I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.
It can all be tracked back to the well-known "Mass assignment/attr_accessible vulnerability" in Rails. Demonstrating that even Github - full of very smart engineers - is vulnerable is just an attempt to raise (even more) exposure to the problem.
Re: Hacked: commit to rails master on GitHub
#8If this is a GitHub exploit, and I were GitHub, I would be talking to law enforcement. This is not how adults disclose software vulnerabilities.
Re: Hacked: commit to rails master on GitHub
#9I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.
He registered a commit using his own account - so he either got the password of a rails admin or he must've found a way to add his keys to the rails github account directly.
The comments on the commit mention he just raised an issue that few people protect the attributes on their models from mass assignment, which… is one way this could happen.
Kind of a dick move, though. Responsible disclosure, doing it on a Sunday morning, etc, etc.
Re: Hacked: commit to rails master on GitHub
#10If this is a GitHub exploit, and I were GitHub, I would be talking to law enforcement. This is not how adults disclose software vulnerabilities.
One of the first comments is a link to where he tried, but the issue was repeatedly closed.