Anyone got any input, ... how they got access in the first place? <= Chances are they got access to your github account credentials or a set of credentials to your repo that also have admin access. How? Who knows... Brute force, weak password, direct access to account details, credential stuffing, etc.

@Igor he says he has 2fa.

2 factor has been turned on in github - was 2FA disabled before?

@VipulNair - The OP might not be the only one with admin access and they never stated were and OP used the word we a couple of times. There is no other way to do this than with access to a set of credentials unless the attacker hacked GitHub directly but then I doubt this would be the only incident of this happening.

If you ever committed any key with admin privileges, even for a second, it was kept on the history. Automated tools can check the repositories looking for keys, and doing automated nuke on those. And security by obscurity does not work well...

2factor wasn't enabled unfortunately, and it was only me that supposedly had access. Is there no log on GitHub anywhere where i could see all interactions with my account? I've obviously left the credentials somewhere. I'd just like to try work out where. I thought possibly they just wiped whilst on my server and pushed the commit with the ransom. So would be useful to see originating up etc if GitHub actually logs this somewhere.

@Raymie - I would contact github directly and see if they will suspend the account completely until you can verify ownership. They should be able to do that given that the content has been wiped and there is a ransom message, that should be a red flag for the admin. I would then make sure you do not have a virus / malware on your device(s) where the credentials could be leaked from and make sure the credentials are not exposed somewhere else (like in a text file on a web server). It goes without saying but change the credentials as soon as you get ownership back.

Also I would not pay any ransom, there is no guarantee the attacker gives you back your source code history (or if they even can if it is truly wiped).

I've contacted github, i've seen some people have success having them restore the repos etc after similar incidents. I'm pretty much locking everything down, all my home network, office network, changing as many passwords as i can and replacing them with private keys etc where possible. Also restricting everything now by ip. Will review alll code before the new server goes live over the weekend.

The threat is they will leak the code. which isn't so great for us as it was basically a proof of concept that we tried on like 50 customers, i failed to put authentication on some backend php files etc. which never would have been found, but now wide open if they leak the code. I won't be paying anything to them, i'm hoping they realise that and just move on to next target. i've called their bluff and emailed saying the repo was just a clone of a public repo with some minor mods.

I had the exact same thing happen to me today as well. This was the wallet in question. This one has been reported at least 5 times. I also have 2FA enabled, and never got a text message indicating they had a successful brute login. My worry is it is a github vulnerability. bitcoinabuse.com/reports/1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA

@Raymie - out of curiosity, what was your project about? I'm trying to figure out if this attack is random, or if there is some commonality somewhere. Looks like both were PHP projects, but that doesn't mean much.

@BrettStubbs yeah mate this is the same address and email etc. Food Online ordering platform, it had a bunch of projects on the back end as well. Maybe an idea to compare what both of us have running on our servers.

@BrettStubbs my guess is they have just run a script against credentials they've managed to hoover up. Likely both our servers are vulnerable to something. I've been checking the logs for hours but can't see anything interesting. Did they wipe all repos in your account? I found it strange they only wiped one of mine that makes me believe it was actually a script they've run. Now and then i've cloned the repo onto my server using user:pass@github etc so it was probably in the history, although i'm usually careful to delete it if i do something like that. most likely cause.

@raymie - yeah, they hit certain repos and ignored others. My servers are fine. They pull from master, but I didn't pull in the last few days, so luckily that file wasn't sitting there for all my users to see. The oddity to me is that even if they logged in as me, it wouldn't explain why I didn't get a text message for 2FA, or why the security logs don't show me giving access to their username 'gitbackup', or the sessions log not showing any activity. I think it was definitely a script, and probably exploits a vulnerability with the github API.

@Raymie, I don't user user:password, I use a ssh key, but maybe it's something related to my Github password.

Did you use Docker Hub with your repository? Docker was recently hacked, and user information may have been leaked.

I can't comment, so am posting as an answer, though it's not an answer. I had the same issue yesterday, which occurred about the same time, with this gitbackup and have contacted github. Github has suspended the account as they are looking into it. The project is a Wordpress site, and we do use docker, though not directly.

Comment-answer from @telhar: "I can't comment, so am posting as an answer, though it's not an answer. I had the same issue yesterday, which occurred about the same time, with this gitbackup and have contacted github. Github has suspended the account as they are looking into it. The project is a Wordpress site, and we do use docker, though not directly."

Having the same problem here. One of my repos got wiped. Got the same bitcoin number as @BrettStubbs. Using bitbucket. I probably had a Docker account.

@Raymie did you have 2FA enabled originally or just enabled it after the incident? It's not entirely clear from your description. Trying to assess if 2FA would have prevented it.

I got this from Atlassian: "Within the past few hours, we detected and blocked an attempt — from a suspicious IP address — to log in with your Atlassian account. We believe that someone used a list of login details stolen from third-party services in an attempt to access multiple accounts."

if you have the code locally see the instructions here security.stackexchange.com/questions/209448/… on how to fix everything

Unfortunately, people are already paying the BTC blockchain.com/btc/address/1J6jLduCXbPyxt5EMTs7iHwdafANy4ThJc

@StefanGabos Wrong hash. The right is that: blockchain.com/btc/address/1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA

How did this virus getting installed ? I'm using mac & linux for everything!

@JonJonCS indeed, wrong address - was randomly checking out bitcoinabuse.com/reports and got carried away

@DanielRuf it seems very slow though for a script-based attack. it must be something like that but why so slow - github.com/… (i know, those are just the public repos and that the private ones are also attacked) but i fear that they are actually cloning the repositories first

:50157634 yes, that seems to be the case, but why not hitting 1000 repos at once?

@DanielRuf yup, that looks like a good way in. but that is just GitHub; the attack happens also for GitLab and BitBucket. I think they rather found username/password lists

@DanielRuf on a second thought, people reported having 2FA enabled before the attack and the attack happened still - so this excludes the attackers having a list of username/passwords. i don't think it is done via access tokens neither

Mine bitbucket account was private, but repo cloned via usingbn https protocol.

Github suspended my account last night and still no acccess, found nothing suspicious in the security tab on github, just logins originating from my own ip and vpn. ~Will check again when i regain access.

Im pretty certain they've just hoovered credentials and used some sort of script. They claim to have downloaded the repos, which they probably have as they say they can provide proof.

for anyone affected, no doubt your server has been breached at some point, just assume that all your credentials have been harvested and take steps to mitigate

change all passwords, enable two factor where possible, private keys for ssh, ufw, make sure only needed services are allowed etc. Remove any insecure scripts from your server,

check over the code that was leaked for vulnerabilities if its running on a live server. Once they leak the repo's there will be plenty of folk going over the code to see what they can find.

Im pretty certain the credentials got hoovered up from my server, probably same as most of us, so like i said regardless til you know the source of how they got the credentials, treat it as a server breach!

It will help.. securing your server, and transferring content to a new setup you know thats not compromised., don't try put people off, they should be doing this at the very minimum.

My guess is that this is only first wave of attacks, like i said if they got my github, they got more than that. Some bot kiddie probably sold someone a whole bunch of github logins, they ran a script against them

TEll you what, we'll all just site here like pricks and let our servers and data get raped...

dude the source was most likely my server, just like everyone elses so taking steps to clean it up and secure it is just common sense.

i said enable it for ssh...

meaning if you had just been using user / pass. setup private key for authentication to your server

They took the string from the server... hence why they only got one repo of mine.

https :// user:pass" git.../raymie/myrepo.git they've harvested that string from my server. So safe to assume my server has been breached.

so any steps to secure and clean the server

I would put money on it that they got access via an insecure script on my server, hoovered up all the credentials they could and sold them on.

Yeah i've been looking at the logs but seen nothing suspicious yet, don't know exactly when the breech has occurred, could have been anytime up to 3 month ago, thats when i last changed my password for github.

Yeah obviously in the ideal world thats how you would do it, but we're all guilty of being lazy at some point lol.

My issue was it was a dev server, so always working on it, wasn't our main production server.#

yeah theres reports that 2fa made no difference

@Raymie link to report?

Check the reddit thread and the original thread for this chat. @BrettStubbs had 2fa enabled.