last day (17 days later) » 

2:51 PM
10
Q: Github account hacked and repo wiped

RaymieOne of my repo's was wiped today and just a message left in its place with a bitcoin ransom. I've no idea how they accessed my account, can't really see anything on github security page. The domain of the email they want me to contact was only created today, google brings nothing up, also seems ...

 
Anyone got any input, ... how they got access in the first place? <= Chances are they got access to your github account credentials or a set of credentials to your repo that also have admin access. How? Who knows... Brute force, weak password, direct access to account details, credential stuffing, etc.
 
@Igor he says he has 2fa.
 
Joe
2 factor has been turned on in github - was 2FA disabled before?
 
@VipulNair - The OP might not be the only one with admin access and they never stated were and OP used the word we a couple of times. There is no other way to do this than with access to a set of credentials unless the attacker hacked GitHub directly but then I doubt this would be the only incident of this happening.
 
If you ever committed any key with admin privileges, even for a second, it was kept on the history. Automated tools can check the repositories looking for keys, and doing automated nuke on those. And security by obscurity does not work well...
 
2:51 PM
2factor wasn't enabled unfortunately, and it was only me that supposedly had access. Is there no log on GitHub anywhere where i could see all interactions with my account? I've obviously left the credentials somewhere. I'd just like to try work out where. I thought possibly they just wiped whilst on my server and pushed the commit with the ransom. So would be useful to see originating up etc if GitHub actually logs this somewhere.
 
@Raymie - I would contact github directly and see if they will suspend the account completely until you can verify ownership. They should be able to do that given that the content has been wiped and there is a ransom message, that should be a red flag for the admin. I would then make sure you do not have a virus / malware on your device(s) where the credentials could be leaked from and make sure the credentials are not exposed somewhere else (like in a text file on a web server). It goes without saying but change the credentials as soon as you get ownership back.
Also I would not pay any ransom, there is no guarantee the attacker gives you back your source code history (or if they even can if it is truly wiped).
 
I've contacted github, i've seen some people have success having them restore the repos etc after similar incidents. I'm pretty much locking everything down, all my home network, office network, changing as many passwords as i can and replacing them with private keys etc where possible. Also restricting everything now by ip. Will review alll code before the new server goes live over the weekend.
The threat is they will leak the code. which isn't so great for us as it was basically a proof of concept that we tried on like 50 customers, i failed to put authentication on some backend php files etc. which never would have been found, but now wide open if they leak the code. I won't be paying anything to them, i'm hoping they realise that and just move on to next target. i've called their bluff and emailed saying the repo was just a clone of a public repo with some minor mods.
 
I had the exact same thing happen to me today as well. This was the wallet in question. This one has been reported at least 5 times. I also have 2FA enabled, and never got a text message indicating they had a successful brute login. My worry is it is a github vulnerability. bitcoinabuse.com/reports/1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA
@Raymie - out of curiosity, what was your project about? I'm trying to figure out if this attack is random, or if there is some commonality somewhere. Looks like both were PHP projects, but that doesn't mean much.
 
@BrettStubbs yeah mate this is the same address and email etc. Food Online ordering platform, it had a bunch of projects on the back end as well. Maybe an idea to compare what both of us have running on our servers.
@BrettStubbs my guess is they have just run a script against credentials they've managed to hoover up. Likely both our servers are vulnerable to something. I've been checking the logs for hours but can't see anything interesting. Did they wipe all repos in your account? I found it strange they only wiped one of mine that makes me believe it was actually a script they've run. Now and then i've cloned the repo onto my server using user:pass@github etc so it was probably in the history, although i'm usually careful to delete it if i do something like that. most likely cause.
 
@raymie - yeah, they hit certain repos and ignored others. My servers are fine. They pull from master, but I didn't pull in the last few days, so luckily that file wasn't sitting there for all my users to see. The oddity to me is that even if they logged in as me, it wouldn't explain why I didn't get a text message for 2FA, or why the security logs don't show me giving access to their username 'gitbackup', or the sessions log not showing any activity. I think it was definitely a script, and probably exploits a vulnerability with the github API.
@Raymie, I don't user user:password, I use a ssh key, but maybe it's something related to my Github password.
 
2:51 PM
Did you use Docker Hub with your repository? Docker was recently hacked, and user information may have been leaked.
 
GitHub suspended my account last night whilst they investigate, I should hopefully hear from them today. I might have just been lucky,. All commits goto slack, I seen the warning commit come through within seconds and changed pass etc immediately.
 
I can't comment, so am posting as an answer, though it's not an answer. I had the same issue yesterday, which occurred about the same time, with this gitbackup and have contacted github. Github has suspended the account as they are looking into it. The project is a Wordpress site, and we do use docker, though not directly.
 
Comment-answer from @telhar: "I can't comment, so am posting as an answer, though it's not an answer. I had the same issue yesterday, which occurred about the same time, with this gitbackup and have contacted github. Github has suspended the account as they are looking into it. The project is a Wordpress site, and we do use docker, though not directly."
 
3:04 PM
Having the same problem here. One of my repos got wiped. Got the same bitcoin number as @BrettStubbs. Using bitbucket. I probably had a Docker account.
 
 
2 hours later…
4:57 PM
@Raymie did you have 2FA enabled originally or just enabled it after the incident? It's not entirely clear from your description. Trying to assess if 2FA would have prevented it.
 
 
1 hour later…
6:14 PM
I got this from Atlassian: "Within the past few hours, we detected and blocked an attempt — from a suspicious IP address — to log in with your Atlassian account. We believe that someone used a list of login details stolen from third-party services in an attempt to access multiple accounts."
 
rab
7:06 PM
I'm having the same issue..

Threat is : "To recover your lost code and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address 1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA and contact us by Email at admin@gitsbackup.com with your Git login and a Proof of Payment. If you are unsure if we have your data, contact us and we will send you a proof. Your code is downloaded and backed up on our servers. If we dont receive your payment in the next 10 Days, we will make your code public or use them otherwise."
 
8:04 PM
It appears to be an orchestrated attack on multiple repos, as we can see here:
https://github.com/search?o=desc&q=1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA&s=indexed&type=Code

https://www.reddit.com/r/git/comments/bk1eco/git_ransomware_anyone_else_been_a_victim/?ref=readnext
 
8:28 PM
if you have the code locally see the instructions here security.stackexchange.com/questions/209448/… on how to fix everything
 
@Raymie go to github.com/settings/security, there is a security history at the bottom
 
Unfortunately, people are already paying the BTC blockchain.com/btc/address/1J6jLduCXbPyxt5EMTs7iHwdafANy4ThJc
 
@StefanGabos Wrong hash. The right is that: blockchain.com/btc/address/1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA
 
Theoretically this could have also been the result of harvesting priate keys and credentials using Node.js packages which have access to the whole system as some packages did this in the past. Interested to see the timeline of the incident and the initial cause.
 
rab
How did this virus getting installed ? I'm using mac & linux for everything!
 
8:45 PM
Linux and macOS are not immune to malware in general but this was no malware attack I think.
 
@JonJonCS indeed, wrong address - was randomly checking out bitcoinabuse.com/reports and got carried away
@DanielRuf it seems very slow though for a script-based attack. it must be something like that but why so slow - github.com/… (i know, those are just the public repos and that the private ones are also attacked) but i fear that they are actually cloning the repositories first
 
@StefanGabos they probably found access to a database with access tokens.
 
:50157634 yes, that seems to be the case, but why not hitting 1000 repos at once?
@DanielRuf yup, that looks like a good way in. but that is just GitHub; the attack happens also for GitLab and BitBucket. I think they rather found username/password lists
 
Right. Unfortunately we do not yet know. Some services provide login forms for all named Git platforms.
 
9:03 PM
@DanielRuf on a second thought, people reported having 2FA enabled before the attack and the attack happened still - so this excludes the attackers having a list of username/passwords. i don't think it is done via access tokens neither
 
access tokens need no 2FA as these directly grant the needed rights - it is just a possibility / an assumption. Would be interesting to get relevant suspicious details from the mentioned security history in the profile settings.
 
rab
Mine bitbucket account was private, but repo cloned via usingbn https protocol.
 
@rab This is probably not relevant how you cloned it to your local harddisk =) Do you see any suspicious activity at github.com/settings/security at the bottom (security history)?
Did you use any external services or connect them as OAuth apps or generate tokens which were used on other platforms?
 
9:41 PM
Github suspended my account last night and still no acccess, found nothing suspicious in the security tab on github, just logins originating from my own ip and vpn. ~Will check again when i regain access.
Im pretty certain they've just hoovered credentials and used some sort of script. They claim to have downloaded the repos, which they probably have as they say they can provide proof.
for anyone affected, no doubt your server has been breached at some point, just assume that all your credentials have been harvested and take steps to mitigate
change all passwords, enable two factor where possible, private keys for ssh, ufw, make sure only needed services are allowed etc. Remove any insecure scripts from your server,
check over the code that was leaked for vulnerabilities if its running on a live server. Once they leak the repo's there will be plenty of folk going over the code to see what they can find.
 
This should not affect serversor the SSH keys afaik.
 
Im pretty certain the credentials got hoovered up from my server, probably same as most of us, so like i said regardless til you know the source of how they got the credentials, treat it as a server breach!
 
Changing things now will not help if they still have access imo. It is like changing the password of a backend of a compromised website and the attackers can still look into the files.
 
10:00 PM
"Jeremy Galloway, a security researcher at Atlassian, which owns BitBucket, told Motherboard in an online chat that the company has seen a lot of users’ repositories getting hit by these hackers. Galloway said he estimates the victims to be at least 1,000, based on internal numbers and online reports. "

https://motherboard.vice.com/en_us/article/vb9v33/github-bitbucket-repositories-ransomware
 
It will help.. securing your server, and transferring content to a new setup you know thats not compromised., don't try put people off, they should be doing this at the very minimum.
 
Still not sure what a server for what you normally only use public keys and deploy keys (read only access) has to do with this here but maybe you know more than I do =)
 
My guess is that this is only first wave of attacks, like i said if they got my github, they got more than that. Some bot kiddie probably sold someone a whole bunch of github logins, they ran a script against them
TEll you what, we'll all just site here like pricks and let our servers and data get raped...
dude the source was most likely my server, just like everyone elses so taking steps to clean it up and secure it is just common sense.
 
Your SSH keyring is on your computer including the private key. It is never stored on external servers. You just auth / login with it. And they probably used tokens (access tokens or OAuth tokens) or tried reused passwords (credential stuffing) or tried rainbow lists against the logins but this would take some time ;-)
A cloned repo has no auth info at all. Just the remote in .git/config - always clone with SSH if possible.
 
10:16 PM
i said enable it for ssh...
meaning if you had just been using user / pass. setup private key for authentication to your server
They took the string from the server... hence why they only got one repo of mine.
 
Well this is something in general. But still there is no access stored in repos or on your server pointing to GitHub or Bitbucket or others normally. You can not push from a repo without the right login / SSH keypair.
 
https :// user:pass" git.../raymie/myrepo.git they've harvested that string from my server. So safe to assume my server has been breached.
 
if you have the user:password in your clone URL (which is never this way on any of the Git platforms) this is a big problem
 
so any steps to secure and clean the server
 
Might be helpful to check the syslogs (accesslog, SSH, and so on) to verify this but I higly doubt this.
Use only SSH to login to your server and not root (basic server hardening).
 
10:22 PM
I would put money on it that they got access via an insecure script on my server, hoovered up all the credentials they could and sold them on.
 
GitHub, GitLab and others only proide these URLs for cloning by default: git@github.com:githubprofile/repo.git and github.com/githubprofile/repo.git so the Git client will use the keypair or ask for the login then. Everything else is wrong.
 
Yeah i've been looking at the logs but seen nothing suspicious yet, don't know exactly when the breech has occurred, could have been anytime up to 3 month ago, thats when i last changed my password for github.
 
Might be good to have 2FA enabled in the future as this would have asked for another generated code.
 
Yeah obviously in the ideal world thats how you would do it, but we're all guilty of being lazy at some point lol.
My issue was it was a dev server, so always working on it, wasn't our main production server.#
yeah theres reports that 2fa made no difference
 
10:44 PM
@Raymie link to report?
 
Check the reddit thread and the original thread for this chat. @BrettStubbs had 2fa enabled.
 

  last day (17 days later) »