Raymie

Excellent will try this when github restore my account. Its been 24 hours since suspension and heard nothing back :/ Pretty sure my server was compromised and thats how they got my credentials. If you've used your login on one of your servers, for all intensive purposes consider your server to have been breached and take necessary actions. Also they offer samples of the code, plus they seem to have the full just took the repo url string with credentials, so yeah assume they cloned it. I think i actually found the script they used to clone..

Check the reddit thread and the original thread for this chat. @BrettStubbs had 2fa enabled.

yeah theres reports that 2fa made no difference

My issue was it was a dev server, so always working on it, wasn't our main production server.#

Yeah obviously in the ideal world thats how you would do it, but we're all guilty of being lazy at some point lol.

Yeah i've been looking at the logs but seen nothing suspicious yet, don't know exactly when the breech has occurred, could have been anytime up to 3 month ago, thats when i last changed my password for github.

I would put money on it that they got access via an insecure script on my server, hoovered up all the credentials they could and sold them on.

so any steps to secure and clean the server

https :// user:pass" git.../raymie/myrepo.git they've harvested that string from my server. So safe to assume my server has been breached.

They took the string from the server... hence why they only got one repo of mine.

meaning if you had just been using user / pass. setup private key for authentication to your server

i said enable it for ssh...

dude the source was most likely my server, just like everyone elses so taking steps to clean it up and secure it is just common sense.

TEll you what, we'll all just site here like pricks and let our servers and data get raped...

My guess is that this is only first wave of attacks, like i said if they got my github, they got more than that. Some bot kiddie probably sold someone a whole bunch of github logins, they ran a script against them

It will help.. securing your server, and transferring content to a new setup you know thats not compromised., don't try put people off, they should be doing this at the very minimum.

Im pretty certain the credentials got hoovered up from my server, probably same as most of us, so like i said regardless til you know the source of how they got the credentials, treat it as a server breach!

check over the code that was leaked for vulnerabilities if its running on a live server. Once they leak the repo's there will be plenty of folk going over the code to see what they can find.

change all passwords, enable two factor where possible, private keys for ssh, ufw, make sure only needed services are allowed etc. Remove any insecure scripts from your server,

for anyone affected, no doubt your server has been breached at some point, just assume that all your credentials have been harvested and take steps to mitigate

Im pretty certain they've just hoovered credentials and used some sort of script. They claim to have downloaded the repos, which they probably have as they say they can provide proof.

Github suspended my account last night and still no acccess, found nothing suspicious in the security tab on github, just logins originating from my own ip and vpn. ~Will check again when i regain access.

GitHub suspended my account last night whilst they investigate, I should hopefully hear from them today. I might have just been lucky,. All commits goto slack, I seen the warning commit come through within seconds and changed pass etc immediately.

@BrettStubbs my guess is they have just run a script against credentials they've managed to hoover up. Likely both our servers are vulnerable to something. I've been checking the logs for hours but can't see anything interesting. Did they wipe all repos in your account? I found it strange they only wiped one of mine that makes me believe it was actually a script they've run. Now and then i've cloned the repo onto my server using user:pass@github etc so it was probably in the history, although i'm usually careful to delete it if i do something like that. most likely cause.

@BrettStubbs yeah mate this is the same address and email etc. Food Online ordering platform, it had a bunch of projects on the back end as well. Maybe an idea to compare what both of us have running on our servers.

The threat is they will leak the code. which isn't so great for us as it was basically a proof of concept that we tried on like 50 customers, i failed to put authentication on some backend php files etc. which never would have been found, but now wide open if they leak the code. I won't be paying anything to them, i'm hoping they realise that and just move on to next target. i've called their bluff and emailed saying the repo was just a clone of a public repo with some minor mods.

I've contacted github, i've seen some people have success having them restore the repos etc after similar incidents. I'm pretty much locking everything down, all my home network, office network, changing as many passwords as i can and replacing them with private keys etc where possible. Also restricting everything now by ip. Will review alll code before the new server goes live over the weekend.

2factor wasn't enabled unfortunately, and it was only me that supposedly had access. Is there no log on GitHub anywhere where i could see all interactions with my account? I've obviously left the credentials somewhere. I'd just like to try work out where. I thought possibly they just wiped whilst on my server and pushed the commit with the ransom. So would be useful to see originating up etc if GitHub actually logs this somewhere.