4 ms·

Hi Yogi, I'm guessing your Github account has been hijacked. Support won't respond to your emails because it could be the attacker impersonating you, or he cou

Hi Yogi, I'm guessing your Github account has been hijacked. Support won't respond to your emails because it could be the attacker impersonating you, or he could still have access to your email and get info that way. This is Standard Operating Procedure I've seen applied on stolen accounts in MMO videogames involving stolen credit cards and organized crime. Sometimes wait time was 6 months with no contact, because they needed to keep the evidence under seal for the police investigation and avoid tipping off the attackers. Your 2-letter nickname and access to important projects makes your account a high-value target. Did you have 2FA enabled? edit: usually the email account got hijacked first, defeating the 2FA/1-time token. SMS is also easily hackable.

ygcodes 6y ago
Yes I have 2FA and MFA enabled!
- minxomat 6y ago
  Another vector is takeover requests via their name squatting policy (that's how I got my username). But those requests shouldn't be approved unless the old account really is inactive. Might have been approved by mistake. Another vector is the as of yet unfixed GitHub "ghost" bug, which I discovered and detailed here: https://github.com/git-rest/spooky https://github.com/git-rest/spooky Note how you can read that repo, but the account https://github.com/git-rest https://github.com/git-rest doesn't exist.
  - bibinou 6y ago
    OP got his 2-letter handle via a takeover request: https://dev.to/yg/how-i-got-two-letter-username-on-github-i12 https://dev.to/yg/how-i-got-two-letter-username-on-github-i1... edit: the ghost repo is cool trick. Is there a writeup anywhere?
    - gus_massa 6y ago
      The OP changed his username in github less than a month ago to to the name of an inactive account? Perhaps the previous user is complaining.
      - aptwebapps 6y ago
        Yeah, but it's not like he did something nefarious. He found an account that was inactive and requested it from support and they gave it to him. If the previous user complained, either he would get to keep it or the previous user would get it - it wouldn't be deleted/disabled and they probably would have communicated something.
    - thephyber 6y ago
      The ghost repo trick sounds similar to a subdomain takeover. I can foresee this being a vector for publishing malicious code.
  - subins2000 6y ago
    does this mean that if I pass away, someone can take over my username and repos under my account ?
    - minxomat 6y ago
      No, from my experience even a single empty repo disqualifies you from takeover. The point is to prevent name squatting, i.e. registering a name and then going nothing with it.
fishywang 6y ago
If GitHub really has reason to suspect that op's account is hijacked, they should be able to figure out at least one of op's email address (simply by the fact that email address is attached to the account long before the hijacking happened), and send some communications there? Or provide an official process of "we suspended your account because we have reason to suspect that your account is hijacked. we won't response to your emails either, this is how to contact us to have your account reinstated"? Also op said they do have 2fa, which makes this excuse even poorer.
- ktm5j 6y ago
  A malicious party could have access to OP's other accounts, maybe OP reuses passwords. It's in the realm of plausibility that they are being cautious not to alert the attacker. If they/authorities want to use the opportunity to observe and collect evidence then I think these actions on GitHub's part are somewhat reasonable, albeit kind of shitty.
jacquesm 6y ago
If the account has been hijacked then they should go out of their way to establish the identity of the original owner rather than to try to wipe it all under the carpet. Having accounts that can be hijacked is a failure of the service provider, not of their users.
mavsman 6y ago
> Your 2-letter nickname and access to important projects makes your account a high-value target. For sure this. People go crazy for this stuff and sell access on the dark web (https://gimletmedia.com/shows/reply-all/v4he6k/ https://gimletmedia.com/shows/reply-all/v4he6k/)
- bibinou 6y ago
  looking at http://web.archive.org/web/20200704143044/www.github.com/yg http://web.archive.org/web/20200704143044/www.github.com/yg, OP had (some) access to @EpicGames, @Jekyll and some Nvidia org.

ygcodes 6y ago

Yes I have 2FA and MFA enabled!

minxomat 6y ago
Another vector is takeover requests via their name squatting policy (that's how I got my username). But those requests shouldn't be approved unless the old account really is inactive. Might have been approved by mistake. Another vector is the as of yet unfixed GitHub "ghost" bug, which I discovered and detailed here: https://github.com/git-rest/spooky https://github.com/git-rest/spooky Note how you can read that repo, but the account https://github.com/git-rest https://github.com/git-rest doesn't exist.
- bibinou 6y ago
  OP got his 2-letter handle via a takeover request: https://dev.to/yg/how-i-got-two-letter-username-on-github-i12 https://dev.to/yg/how-i-got-two-letter-username-on-github-i1... edit: the ghost repo is cool trick. Is there a writeup anywhere?
  - gus_massa 6y ago
    The OP changed his username in github less than a month ago to to the name of an inactive account? Perhaps the previous user is complaining.
    - aptwebapps 6y ago
      Yeah, but it's not like he did something nefarious. He found an account that was inactive and requested it from support and they gave it to him. If the previous user complained, either he would get to keep it or the previous user would get it - it wouldn't be deleted/disabled and they probably would have communicated something.
  - thephyber 6y ago
    The ghost repo trick sounds similar to a subdomain takeover. I can foresee this being a vector for publishing malicious code.
- subins2000 6y ago
  does this mean that if I pass away, someone can take over my username and repos under my account ?
  - minxomat 6y ago
    No, from my experience even a single empty repo disqualifies you from takeover. The point is to prevent name squatting, i.e. registering a name and then going nothing with it.

fishywang 6y ago

If GitHub really has reason to suspect that op's account is hijacked, they should be able to figure out at least one of op's email address (simply by the fact that email address is attached to the account long before the hijacking happened), and send some communications there? Or provide an official process of "we suspended your account because we have reason to suspect that your account is hijacked. we won't response to your emails either, this is how to contact us to have your account reinstated"? Also op said they do have 2fa, which makes this excuse even poorer.

ktm5j 6y ago
A malicious party could have access to OP's other accounts, maybe OP reuses passwords. It's in the realm of plausibility that they are being cautious not to alert the attacker. If they/authorities want to use the opportunity to observe and collect evidence then I think these actions on GitHub's part are somewhat reasonable, albeit kind of shitty.

jacquesm 6y ago

If the account has been hijacked then they should go out of their way to establish the identity of the original owner rather than to try to wipe it all under the carpet. Having accounts that can be hijacked is a failure of the service provider, not of their users.

mavsman 6y ago

> Your 2-letter nickname and access to important projects makes your account a high-value target. For sure this. People go crazy for this stuff and sell access on the dark web (https://gimletmedia.com/shows/reply-all/v4he6k/ https://gimletmedia.com/shows/reply-all/v4he6k/)

bibinou 6y ago
looking at http://web.archive.org/web/20200704143044/www.github.com/yg http://web.archive.org/web/20200704143044/www.github.com/yg, OP had (some) access to @EpicGames, @Jekyll and some Nvidia org.