4 ms·

The blog title is a significant misnomer, IMO. The vulnerability has nothing to do with public keys, but with the incorrect configuration/use of a Rails feature

by woodrow 15y ago

The blog title is a significant misnomer, IMO. The vulnerability has nothing to do with public keys, but with the incorrect configuration/use of a Rails feature. This vulnerability was then exploited to add a public key to the rails/rails repo, but apparently could have been used for other purposes [1] that are unrelated to pushing to a repo. This seems like an omission that may have people worrying about the wrong things or drawing the wrong conclusions if they don't take the time to understand what actually happened. [1] http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.html http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.htm...

cdcarter 15y ago
The vulnerability was in github, allowing a public key to be added to any project. The vulnerability was introduced to github by misusing a rails feature.
- woodrow 15y ago
  From the linked blog post by homakov: Since guys in rails issues ingored me and my issue I got spare time to test it on the first website i had in mind. github. That was pretty funny. Firstly, I could write post from 1234 year or 4321. Then, I could make a post pretending i am DHH. That was funny too. Then I could wipe any post in any project. That wasn't that funny but pretty dangereous. It got more curious. Today I can pull/commit/push in any repository on github. Jack pot. Hence my implicit assertion that this is broader than commit access (via public keys) and has nothing to do with cryptography/public keys itself. To be fair, in the first sentence of the github blog post, mojombo goes on to more precisely state "a security vulnerability in the public key update form", but it appears that this may not be the full extent of things. For an example of the other vulnerabilities homakov mentioned in his blog post, see [2] where the contents of an issue was changed. [2] https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation#comment-17306 https://github.com/blog/1068-public-key-security-vulnerabili... (Edited for formatting.)

by woodrow 15y ago

cdcarter 15y ago

The vulnerability was in github, allowing a public key to be added to any project. The vulnerability was introduced to github by misusing a rails feature.

woodrow 15y ago
From the linked blog post by homakov: Since guys in rails issues ingored me and my issue I got spare time to test it on the first website i had in mind. github. That was pretty funny. Firstly, I could write post from 1234 year or 4321. Then, I could make a post pretending i am DHH. That was funny too. Then I could wipe any post in any project. That wasn't that funny but pretty dangereous. It got more curious. Today I can pull/commit/push in any repository on github. Jack pot. Hence my implicit assertion that this is broader than commit access (via public keys) and has nothing to do with cryptography/public keys itself. To be fair, in the first sentence of the github blog post, mojombo goes on to more precisely state "a security vulnerability in the public key update form", but it appears that this may not be the full extent of things. For an example of the other vulnerabilities homakov mentioned in his blog post, see [2] where the contents of an issue was changed. [2] https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation#comment-17306 https://github.com/blog/1068-public-key-security-vulnerabili... (Edited for formatting.)