12 ms·
We've patched and fixed this on GitHub.
by holman 15y ago
We've patched and fixed this on GitHub.
- arturadib 15y agoTime from exploit to fix in production: < 1h. On a Sunday morning. I'd buy Github stock if I could.
- pyre 15y agoIt doesn't hurt that the vulnerability was already discussed in a bug report by the 'attacker.' I'd imagine it would have taken a longer time had they needed to track down how exactly this happened, though I guess I'm making an assumption on what their logging/auditing/reporting is like.
- jberryman 15y agoRight, I'm kind of baffled by the posters on the bug report calling this a "0-day" exploit.
- sausagefeet 15y agoAt the very least you'd probably be getting it on the cheap at that point.
- lucaspiller 15y agoGood work. Please could you write a post explaining what you did, so others using Rails can do the same?
- momoro 15y agoThey probably simply made user_id protected on whatever table controls commit permissions.
- bgentry 15y agoDo you plan on notifying customers whose repos he accessed? This looks like more than just a minor breach if he was able to give himself admin rights and had read/write access to any repo.
- willlll 15y agoHopefully they had the proper audit logs already in place.
- Ecio78 15y agoActually the problem is not which repos he accessed (they can easily determined by looking at their logs), the problem is if/how_many other repos have been accessed by blackhats who knew this exploit before, and what kind of commit they've done to all these projects.
- maratd 15y agoAs a paying customer, whose sole reason in paying you is to keep his data secure, I expect a bit more than "we fixed it" ... details please.
- holman 15y agoIt's a lot quicker to publicize a vulnerability than it is to patch, ascertain the scope, and verify the current situation. We're taking the time to make sure the information we'll relay to you is accurate.
- technoweenie 15y agohttps://github.com/blog/1068-public-key-security-vulnerability-and-mitigation https://github.com/blog/1068-public-key-security-vulnerabili...
- grabastic 15y agoI am also a paying customer, but I don't feel entitled to a thorough explanation anywhere but through their own official channels... even if one of their employees has chosen to comment here.
- maratd 15y ago> I don't feel entitled to a thorough explanation anywhere but through their own official channels Nor do I. However, there was no indication given that an explanation would be given through official channels. If that indication was made with the "fixed it" comment, trust me, I would have kept my mouth shut and waited.
- grabastic 15y agoI read more negativity into your comment than I should have. Apologies.
- ssclafani 15y agoFor reference, it's easy to determine if a Rails application is vulnerable to mass assignment attacks by attempting to set an attribute that is unlikely to exist (e.g., user[asdfg]). In the majority of cases a 500 error will be returned if the application is vulnerable.
- nirvdrum 15y agoSorta. You can blacklist instead of whitelist. The blacklist could make you secure, while still resulting is this 500.
- cagenut 15y agoThank you commenter "holman" on this third party discussion site, but as a paying customer could github please post something official somewhere like now
- mcav 15y agoHolman works at GitHub.
- fijal 15y agoCan you give him some slack? It's sunday, he says the vulnerability is fixed and this is all you should care about. Surely you would rather have him looks if it's really fixed rather than issuing an official statement. Surely an official statement can wait a day or two no?
- krobertson 15y agoLike this? https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation https://github.com/blog/1068-public-key-security-vulnerabili...
- angersock 15y agoYou've apparently also suspended his account...? (http://homakov.blogspot.com/2012/03/im-disappoint-github.html http://homakov.blogspot.com/2012/03/im-disappoint-github.htm...) If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).
- grabastic 15y agoHis behavior should not be rewarded.
- angersock 15y agoWhy? He didn't cause any harm, disclosed quickly, and only acted after being ignored by the framework community (multiple times, it would seem). It's not even being "rewarded"--it's being "not punished". Wouldn't you like to have people spot vulnerabilities on your site and report them promptly without also breaking things? Seems a little ungrateful, yeah? If we are all going to migrate to the cloud and assume our services (no longer under our control) are handled competently, we must place a higher premium on vetting that competency.
- grabastic 15y agoSo if you had a vulnerable product and this gentleman altered one of your customer's pages without permission you would be grateful? That is strange to me.
- angersock 15y agoProvided that the he did so and made the change public, and the modification was not malicious? Yes. I'd even send him a thank-you email, and add him to our list of contributors. I'd then of course contact the customer (probably over phone, as quickly as possible), explain the vulnerability, explain what happened, and explain how we were fixing it. Then I'd write a post about it, and put it on the front of the site. That's how you do business.