11 ms·
Microsoft's GitHub account allegedly hacked, 500GB stolen
- angel_j 6y agoPlot twist, all the data was open source
- FanaHOVA 6y agoSo many people were paranoid about Microsoft reading their private source code post-acquisition; turns out it was the other way :)
- jug 6y agoSounds sketchy given what the employee from Microsoft commented. The article is also not completely up to date with their “interesting” findings. For example, while a language projection for the Windows Runtime to Rust is interesting, it is also a public repository: https://github.com/microsoft/winrt-rs https://github.com/microsoft/winrt-rs I’d take this article with a grain of salt until we hear more.
- giancarlostoro 6y agoI am pretty sure anything from Microsoft on GitHub is intended to be open source eventually. Theres no reason they dont have proprietary projects in their own internal version control systems.
- DiabloD3 6y agoMicrosoft had multiple Github Enterprise accounts before the acquisition, owned by multiple teams independently inside of Microsoft. They chose to use these instead of Microsoft's own internal repository (some VSS-based thing I think), which management ordered them to use. More internal Microsoft code was being hosted by Github instead by Microsoft. However, the Microsoft account on Github seems to only be public repositories, or repositories being prepped to be public. Actual internal stuff is hosted by one or more Github Enterprise accounts, the alleged hack does not claim they were hacked as well.
- scared2 6y agoIn this sense "hacked" doesn't make sense. 8f everything was intended for open source.
- badRNG 6y agoI think there are still two concerns here even if everything is intended to eventually become open source. One, this doesn't address exactly how the repo was compromised. Likely one of the many folks with access had their credentials compromised, but until we know, there may be risk to other projects. Two, as the article mentions, it may not have had all passwords or API keys scrubbed.
- tlbsofware 6y agoThe culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.
- dependenttypes 6y agoHaving openpgp-signed commits would prevent such an issue.
- jlgaddis 6y agoWould it? Couldn't the "hacker" have simply generated a new GPG key and added it to the account he had control of?
- dependenttypes 6y agoThe users would have specific keys trusted.
- as300 6y agoSure, but isn't the point of git to be able to roll back all changes on any branch? And since GitHub is owned by Microsoft, they themselves would surely be able to regain ownership of the account. This seems like a non-story.
- cameronbrown 6y agoConsidering Microsoft owns GitHub, there's no reasons their internal teams aren't choosing to host more code on there.
- ChuckNorris89 6y agoThey probably had their own internal version control for their IP before they bought GitHub. Can't imagine they suddenly migrated all their stuff to GitHub.
- ComputerGuru 6y agoThat acquisition happened a blink of an eye ago, in the grand scheme of things. Things don’t change that fast, especially when you have the sheer amount and scope of DevOps and integrations that MS has. With the possible (but even then still unlikely) exception of greenfield projects, there’s basically no chance that anything but open source (or soon to be open source) MS projects were hosted on GitHub.
- input_sh 6y agoThey also have a competing service: Azure DevOps (formerly Team Foundation Server, Visual Studio Team System), which somehow has barely anything to do with Azure. I believe that the stuff they're open sourcing go on GitHub, while the internal tools go on Azure DevOps. They also have their own VCS (Git alternative) called Team Foundation Version Control (TFVC), though I have no clue why they keep that thing around. They've also had Microsoft Visual SourceSafe, but even they themselves didn't really use that. On a side note, they really suck at naming things.
- outside1234 6y agoAzure Devops is increasingly based on the same code as Github. Github Actions and Azure Devops Pipelines, for example, utilize the same infrastructure in my understanding.
- myko 6y agoIt's a lot nicer to use on the GitHub side, and more organized (.github/workflows/foo.yaml vs a yaml in the root of the project for all "Actions")
- cptskippy 6y agoMicrosoft is moving everything to GitHub. We were at a MS training center recently for Azure DevOps training and the trainer said they were porting DevOps features without equivalent to GitHub and bringing a few things like YAML to DevOps in preparation for the transition.
- sproketboy 6y ago> I’d take this article with a grain of salt until Until you M$ shills have more time to cover this up. Fuck you shill.
- 6c696e7578 6y agoSo a closed source software company buys an open source tool company, and inadvertently make closed source open source! Or, in other words, if you want to keep something private, don't put it in the "cloud"!
- capableweb 6y agoMe and a friend were having coffee and were discussing secrets something like 10 years ago. The conclusion of our conversation was "Everything always comes out" (translated from Swedish [context was some gossip that eventually leaked about our common friend]) which boils down to that the only way you can really ensure something stays secret forever, is by only having it in your mind and not sharing it. As soon as you share it _anywhere_, there is a risk of it leaking somewhere. The lesson I carry is that the more secret it something is, the closer to my brain it is. Top-secret = only in my head, little bit secret = encrypted on my harddrive, little less secret = encrypted in the cloud, not secret at all = just dumped in a Google Drive account
- 6c696e7578 6y agoMentally, tell your self there are some very personal photos in the data. Then most people think more carefully about where they store it :)
- kyuudou 6y ago>"Everything always comes out" (translated from Swedish) "What's done in darkness will come to light" is an oft-used adage in English of Biblical origin. Many variations. I agree with it, too.
- lcfcjs2 6y agoWhat about 99% of companies that are hosted in the cloud, and never had a breach? Your logic is akin to don't drive a car, and you'll never get into a car crash.
- binarysneaker 6y agoSomeone else's compu... yeah, yeah. Yawn. Move along.
- searchableguy 6y ago> In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items. Other than private keys or sensitive info being left behind, doesn't appear to be severe. Looks nothing burger given the data until more is released. > Microsoft employee Sam Smith replied to Under the Breach's tweet stating that he thought the leak was fake as "Msft has a “rule” that GitHub repos must be public within 30 days." Curious, what does microsoft use internally? Instance of github enterprise? Azure devops?
- badRNG 6y agoI don't think the potential leak of source code is the worry for Microsoft here, it is the fact that they got access in the first place, as that could have security implications for other projects.
- pbhjpbhj 6y agoWell if MS can't secure their own code on GitHub, surely anyone with private repos has to be thinking to jump ship (at least until the flaws are identified and fixed)?
- ytch 6y ago> Curious, what does microsoft use internally? Instance of github enterprise? Azure devops? I guess they have internal Git servers, since they develop VFS for Git[1] to handle large amount of files in git, but IIRC github isn't support it yet [1]https://vfsforgit.org/ https://vfsforgit.org/
- bgdnyxbjx 6y agoYes. Most teams are using git repos in Azure DevOps. Anything in GitHub is supposed to be made public pretty quickly.
- oldmanhorton 6y agoYes, basically everything is azure devops internally, spread across numerous tenants for different orgs.
- deleted 6y ago[deleted]
- rvz 6y ago> This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. Well, someone asked the other day whether or not private repositories on GitHub were safe: [0] I think you now have a concrete answer regardless if this is true or not. I have already made the case to privately self-host, especially if you're a large enterprise, but preferably on-site [1][2] to avoid these types of attacks and in the process to reduce costs like this as many were discussing in other HN discussion [3], but here we are. If they can do it to Microsoft, they can do it to anyone else who has a GitHub account. [0] https://news.ycombinator.com/item?id=23057769 https://news.ycombinator.com/item?id=23057769 [1] https://news.ycombinator.com/item?id=22960579 https://news.ycombinator.com/item?id=22960579 [2] https://news.ycombinator.com/item?id=22868406 https://news.ycombinator.com/item?id=22868406 [3] https://news.ycombinator.com/item?id=23089999 https://news.ycombinator.com/item?id=23089999
- Drip33 6y ago> If they can do it to Microsoft, they can do it to anyone else who has a GitHub account. It happened to Cisco as well a while back, I have a copy of that source somewhere.
- jacquesm 6y agoYou probably shouldn't readily confess to hoarding stolen property in an online forum.
- Drip33 6y agoNot a crime to possess information, not property, that was illegally obtained in either USA or my own country provided you didn't counsel or encourage the original theft.
- jacquesm 6y agoThe fact that you did not commit the initial theft does not put you in the clear. Source: a lawsuit that I won with exactly that theme. I don't know where you are but the bulk of the jurisdictions would not look favorable upon you. I agree that your loose interpretation of the law might work out in your favor. But just like downloading copyrighted material is illegal so is downloading copyrighted data from a source that you know does not have the option to legally give you a license to copy or use that data. So from one aspect of the law you are in the clear, from another this is an open-and-shut case of copyright violation and on top of that you will have to work real hard to prove that you weren't the one to steal it in the first place using the 'upload to someplace anonymous, then download it again' trick to whitewash the data. Some risks are worth taking, this particular one I'd think long and hard about it if the counterparty is the proverbial 800 pound gorilla.
- antidaily 6y agoWE JUST WANT SUNRISE BACK
- somurzakov 6y agoif it is in the cloud, it will be eventually hacked
- duxup 6y agoWouldn't that mean any computer connected to the internet shares that risk?
- somurzakov 6y agoyeah, that's why in an average on-prem setup you usually would have firewalls, DMZs, IDS/IPS and all the good stuff - and people have been doing on-prem security for decades and accumulated an enormous wealth of knowledge and practice. in cloud - it all new. people are still figuring out how to deploy their software so that it works both for users and developers. That's why on average onprem is more secure than cloud.
- duxup 6y agoMaybe I'm crazy but I'm not sure all that security makes things more secure than the cloud. I feel like the hacks I hear about are pretty evenly distributed between cloud and on prem type setups... and most of the big ransomware attacks are almost exclusive to on prem.
- Jonnax 6y ago"new" the cloud is not new. AWS was launched in 2006. Also firewalls/DMZ/IDS has nothing to do with a SaaS offering from GitHub. That on prem setup you mentioned would be practiced by GitHub. My opinion of general on-prem security is that it's often haphazard and updates are almost never applied. But also a lot of on prem security practices hamper developers and users. Because they rely on decades old outdated ways of working. Also your comment makes no sense as this is likely to be a hack through stolen credentials.
- deleted 6y ago[deleted]
- 6y ago
- westoque 6y agoNot sure if anyone knows but if you use AWS, you can actually create your own repository there for your organization. it doesn’t have the GitHub UI or features like issues, but should going in the right direction where your organization owns your private repos.
- colonwqbang 6y agoHaving your repo in Amazon's cloud instead of Microsoft's cloud doesn't mean that you "own" it to a greater degree, does it? It's just a different company holding the keys for you.
- westoque 6y agoTrue. It's just a lot safer because of how AWS has their permissions/access/ACL setup. Not to mention the attack surface is less since you don't expose your repo organization name, repo users, etc like they have it out in open in GitHub.
- MagnificRogue 6y agoHow's this different from doing the same thing in Azure?
- eugenekolo 6y agoAwfully boring things to breach. Not very exciting except for the fact that some employee probably installed nudez.exe.
- deleted 6y ago[deleted]
- tomxor 6y ago> Overall, from what was shared, there does not appear to be anything significant for Microsoft to worry about, such as Windows or Office source code. > In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items.
- anticensor 6y agoTL;DR: Microsoft failed to protect its own secrets
- benatkin 6y agoMicrosoft stands to benefit from getting their private code exposed, because they can use it to claim that open source competitors are ripping it off. https://en.wikipedia.org/wiki/ReactOS#Internal_audit https://en.wikipedia.org/wiki/ReactOS#Internal_audit https://www.theregister.co.uk/2019/07/03/reactos_windows_research_kernel_claim/ https://www.theregister.co.uk/2019/07/03/reactos_windows_res...
- DoctorOW 6y agoFrom your Wikipedia link: > Also, the 2004 leaked Windows source code was not seen as legal risk for ReactOS, as the trade secret was considered indefensible in court due to broad spread. This sounds like Microsoft can't benefit from a public leak.
- austincheney 6y agoThat sounds like a fairly weak argument, because IP protections still apply to open source, except for trade secrets. The degree of protection is dictated by a project's license, or if in the absence of a license then a nation's default copyright status. In your first ReactOS example from 2006 it wasn't even Microsoft that discovered or claimed the problematic code violation. It doesn't look like Microsoft was involved at all.
- afrcnc 6y agoI looked at this yesterday. 90% of it is garbage files from a Chinese developer, or projects that have been open-sourced for 3-4 years. That's not how "leaks" and "hacked" works the last time I checked.
- rafaelreinert 6y agoThe most impressive thing is that Microsoft has more than 3k projects (with forks) on GitHub as public repo
- deleted 6y ago[deleted]
- babycake 6y agoSo is there a list somewhere to see if we were affected?
- me_again 6y agoYou're not affected. Even if real this is not a breach of user data.
- scared2 6y ago500gb is too big, any information about the content?
- wp381640 6y agoI feel vindicated for my own insistence that private repos also get scanned and purged of secrets
- peterwwillis 6y agoGentle reminder that any private repository is sensitive, because the people pushing to them might not be as careful with what they push, because it's private. There are hundreds of different kinds of credentials that can be hidden all throughout the history of a Git repo (in code, in logs, in comments, binary blobs, etc). If you don't have a very robust credential scanner operating continuously, and you have a large organization, you probably have active credentials hidden in your private repos.
- ChrisSD 6y agoConsidering these repos are meant to be made public within 30 days, I'd hope Microsoft employees would be more careful when pushing. Leaving it to a last minute cleanup sounds like a recipe for disaster.
- dependenttypes 6y agoI think that "leaked" would be a better choice compared to "stolen". You can't "steal" source code, unless if somehow you remove the original (such as if the source code is stored on paper in a safe somewhere and there are no copies and someone goes and steals it).
- naringas 6y agoor if during the hack, the code was deleted after copying regardless, I agree.
- factorialboy 6y agoFrom the article: > Microsoft employee Sam Smith replied to Under the Breach’s tweet stating that he thought the leak was fake as “Msft has a “rule” that GitHub repos must be public within 30 days.” Does that mean MS bans the use of GitHub for permanently storing private repos?
- Havoc 6y agoComment above says their private stuff is on azure devops
- orta 6y agoWe (the TypeScript team) have a bunch of private repos (blog post drafts, planning docs, reproduction repos, rando internal tooling ) on GitHub that are many years old. I'm pretty sure that Sam was mistaken here.
- wwwigham 6y agoTo be fair, we had to file for exceptions to the 30 day policy for a lot those. Not that any of them are terribly important to be private; a private GitHub repo is just a convenient discussion form for collaboratively composing blog posts and such (change tracking and reviews are so nice). The blog post one, in particular, probably gets a pass because everything composed on it is eventually published in the open anyway (albeit without the discussion and editorial history).
- hellozebi 6y agoxx"><svg/onload=alert(0);><"hh
- hundchenkatze 6y agocool.
- hellozebi 6y agohh"><svg/onload=alert(0);><hh
- dgentile 6y agoEpic HTML hacker here
- kats 6y agoGitHub reliability is not high enough to support the way people are using it. The administration of the site is not predictable enough, the site has frequent downtime, and there are security issues.