6 ms·

We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and githu

We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!

morpheuskafka 7y ago
If they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone with access to the org, they could do everything through the web interface which is signed by a common Github key.
- DuskStar 7y ago
  I trust that GitHub key less than personal keys for exactly that reason.
- akerl_ 7y ago
  Commits made via the UI aren’t signed at all. There is no “common github key” for signing commits
  - morpheuskafka 7y ago
    https://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5928894c23a54ddcff8524 https://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5... https://imgur.com/a/fSKnL9C https://imgur.com/a/fSKnL9C
pilif 7y ago
That’s not just on github. That’s totally a feature of git itself. You can set the email address to whatever you want.
- jolmg 7y ago
  Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a user but signed by a key the user didn't inform Github of. Likewise, I wonder if git differentiates signatures where the keys are set as trusted in gnupg, and those that are not.
  - msbarnett 7y ago
    > Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. They do this
  - tpetry 7y ago
    Github could simply reject commits with email addresses not added to your account. As you need to verify every email you add to your account this problem would be solved instantly.
    - detaro 7y ago
      and be replaced by a bunch of other problems instead. E.g. no publishing of existing repos on Github if they happen to contain a commit with a non-linked address...
    - jolmg 7y ago
      One wouldn't be able to upload an existing open source repo with loads of existing contributors. That seems to really go against Github's mission of being a universal, easy-access hub for open source git repositories.
    - dragonwriter 7y ago
      > Github could simply reject commits with email addresses not added to your account. Sure, if GitHub wanted to completely abandon the decentralized nature of Git and be a completely centralized system. Which it would love to, I'm sure, but I don't think the user base is quite ready for them to completely shut off any repository with any commits not made by Github users, and posted to GitHub through the account of the user who made the commit, which is what you are suggesting.
ericfrederich 7y ago
... and today PGP was poisoned
- Lowkeyloki 7y ago
  Link, please?
  - zenexer 7y ago
    Probably this: https://www.zdnet.com/article/openpgp-flooded-with-spam-by-unknown-hackers/ https://www.zdnet.com/article/openpgp-flooded-with-spam-by-u... It has no effect on GitHub, though, which doesn’t use keyservers as part of its validation process.
- aaronmdjones 7y ago
  PGP still works fine. It's SKS that doesn't, but you don't need SKS to use PGP.
sebazzz 7y ago
Isn't commit signing a bit like NuGet package signing? Not worth it unless _everyone_ does it all the time? Any valid commit doesn't necessarily invalidate unsigned commits. It only means this commit is really done by me, but it doesn't me the other commit wasn't done by me.
- zenexer 7y ago
  Yes, but there are organizations that require all commits to be signed.
- ilammy 7y ago
  When you sign git commit, you do not sign your diff but the whole source tree as you see it. Effectively, you're vetting all prior commits on the branch. Thus maintainers usually sign merge commits and it's their job to confirm that commits don't do anything shady and come from people they claim to come from.
  - justincormack 7y ago
    But github encourages merges through the website, which means they are not signed.
userbinator 7y ago
I wonder if it was an actual outsider attack, or just a disgruntled (ex-)employee?
justinjlynn 7y ago
> We are lucky that they decided to vandalize instead of hiding something. We do NOT know this.
- steelframe 7y ago
  >> We are lucky that they decided to vandalize instead of hiding something. > We do NOT know this. Well, at least we know that the attackers wanted their activities to be noticed at this point in time. I have reasons to suspect that this is a compromised account, in which case there should be enough forensics info to figure out what the scope of the damage is.
chrisseaton 7y ago
> We are lucky that they decided to vandalize instead of hiding something. How on earth do you know they haven't done both?!
- deleted 7y ago
  [deleted]
- tus88 7y ago
  Git commit hashes are pretty safe.
  - peterwwillis 7y ago
    To verify old hashes, with a backup. But anyone with access can just push a new commit with an arbitrary author field. Without code signing it'd be very difficult to tell who actually pushed it. (Probably GitHub has logs you could check, but if the attacker could get on the corporate network it'd just be a NAT IP, and more sophisticated attackers can spoof or MITM)
  - chrisseaton 7y ago
    Aren't they changing the hash algorithm specifically because they're no longer safe?
    - tus88 7y ago
      Theoretically no longer safe, but to insert a compromise commit matching another one that looks like normal code is close to impossible.
russell_h 7y ago
They still pretty visibly log the push event with the identity of the user whose credentials were used, so what you're describing is pretty easy to spot.
the_pwner224 7y ago
> Always sign your commits! Unfortunately PGP is fundamentally broken. Any identity (email address) can be trivially DoS'd by anyone, because the keyservers are (by design) write-only databases which anyone can add to. https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d695...
- mbrumlow 7y ago
  I think that actually means the notion of keyservers are fundamentally broken, not PGP. I don't need a key server for me to sign or validate that something was signed by who it said it was if exchanged my keys via a secure means.
- zenexer 7y ago
  GitHub’s PGP signing feature doesn’t make use of keyservers. You have to explicitly add a PGP key to your account for GitHub to acknowledge that your commits are signed.

morpheuskafka 7y ago

If they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone with access to the org, they could do everything through the web interface which is signed by a common Github key.

DuskStar 7y ago
I trust that GitHub key less than personal keys for exactly that reason.
akerl_ 7y ago
Commits made via the UI aren’t signed at all. There is no “common github key” for signing commits
- morpheuskafka 7y ago
  https://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5928894c23a54ddcff8524 https://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5... https://imgur.com/a/fSKnL9C https://imgur.com/a/fSKnL9C

pilif 7y ago

That’s not just on github. That’s totally a feature of git itself. You can set the email address to whatever you want.

jolmg 7y ago
Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a user but signed by a key the user didn't inform Github of. Likewise, I wonder if git differentiates signatures where the keys are set as trusted in gnupg, and those that are not.
- msbarnett 7y ago
  > Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. They do this
- tpetry 7y ago
  Github could simply reject commits with email addresses not added to your account. As you need to verify every email you add to your account this problem would be solved instantly.
  - detaro 7y ago
    and be replaced by a bunch of other problems instead. E.g. no publishing of existing repos on Github if they happen to contain a commit with a non-linked address...
  - jolmg 7y ago
    One wouldn't be able to upload an existing open source repo with loads of existing contributors. That seems to really go against Github's mission of being a universal, easy-access hub for open source git repositories.
  - dragonwriter 7y ago
    > Github could simply reject commits with email addresses not added to your account. Sure, if GitHub wanted to completely abandon the decentralized nature of Git and be a completely centralized system. Which it would love to, I'm sure, but I don't think the user base is quite ready for them to completely shut off any repository with any commits not made by Github users, and posted to GitHub through the account of the user who made the commit, which is what you are suggesting.

ericfrederich 7y ago

... and today PGP was poisoned

Lowkeyloki 7y ago
Link, please?
- zenexer 7y ago
  Probably this: https://www.zdnet.com/article/openpgp-flooded-with-spam-by-unknown-hackers/ https://www.zdnet.com/article/openpgp-flooded-with-spam-by-u... It has no effect on GitHub, though, which doesn’t use keyservers as part of its validation process.
aaronmdjones 7y ago
PGP still works fine. It's SKS that doesn't, but you don't need SKS to use PGP.

sebazzz 7y ago

Isn't commit signing a bit like NuGet package signing? Not worth it unless _everyone_ does it all the time? Any valid commit doesn't necessarily invalidate unsigned commits. It only means this commit is really done by me, but it doesn't me the other commit wasn't done by me.

zenexer 7y ago
Yes, but there are organizations that require all commits to be signed.
ilammy 7y ago
When you sign git commit, you do not sign your diff but the whole source tree as you see it. Effectively, you're vetting all prior commits on the branch. Thus maintainers usually sign merge commits and it's their job to confirm that commits don't do anything shady and come from people they claim to come from.
- justincormack 7y ago
  But github encourages merges through the website, which means they are not signed.

userbinator 7y ago

I wonder if it was an actual outsider attack, or just a disgruntled (ex-)employee?

justinjlynn 7y ago

> We are lucky that they decided to vandalize instead of hiding something. We do NOT know this.

steelframe 7y ago
>> We are lucky that they decided to vandalize instead of hiding something. > We do NOT know this. Well, at least we know that the attackers wanted their activities to be noticed at this point in time. I have reasons to suspect that this is a compromised account, in which case there should be enough forensics info to figure out what the scope of the damage is.

chrisseaton 7y ago

> We are lucky that they decided to vandalize instead of hiding something. How on earth do you know they haven't done both?!

deleted 7y ago
[deleted]
tus88 7y ago
Git commit hashes are pretty safe.
- peterwwillis 7y ago
  To verify old hashes, with a backup. But anyone with access can just push a new commit with an arbitrary author field. Without code signing it'd be very difficult to tell who actually pushed it. (Probably GitHub has logs you could check, but if the attacker could get on the corporate network it'd just be a NAT IP, and more sophisticated attackers can spoof or MITM)
- chrisseaton 7y ago
  Aren't they changing the hash algorithm specifically because they're no longer safe?
  - tus88 7y ago
    Theoretically no longer safe, but to insert a compromise commit matching another one that looks like normal code is close to impossible.

russell_h 7y ago

They still pretty visibly log the push event with the identity of the user whose credentials were used, so what you're describing is pretty easy to spot.

the_pwner224 7y ago

> Always sign your commits! Unfortunately PGP is fundamentally broken. Any identity (email address) can be trivially DoS'd by anyone, because the keyservers are (by design) write-only databases which anyone can add to. https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d695...

mbrumlow 7y ago
I think that actually means the notion of keyservers are fundamentally broken, not PGP. I don't need a key server for me to sign or validate that something was signed by who it said it was if exchanged my keys via a secure means.
zenexer 7y ago
GitHub’s PGP signing feature doesn’t make use of keyservers. You have to explicitly add a PGP key to your account for GitHub to acknowledge that your commits are signed.