4 ms·
Ghrc.io appears to be malicious
- arjvik 1y agoTook the article pointing out that the c and r were transposed for me to even notice there was a problem!
- SoftTalker 1y agoYep this is the sort of typo error I make probably 10 times a day.
- javchz 1y agoWhat it's funny it's that because tokenization there is a non zero chance a LLM audit may not see anything wrong here, similar to the strawberry problem.
- TobTobXX 1y agoNah, cr and rc are different tokens and LLMs would have no issues telling them apart. An older model might have trouble explaining that cr and rc are similar and can thus get easily mixed up, but the characters are probably more different to the LLM than they are to us.
- TehCorwiz 1y agoWhat about all that GitHub training data using the wrong domain? Even being a different token it’s still being trained as a correct value.
- echelon 1y agoThe problem here is GitHub's terrible domain name. The container registry has a horrible name.
- Gigachad 1y agoWhy does it seem companies hate subdomains so much? Why is this not just registary.github.com or something? It's like they are trying to get people to fall for phishing by creating so many random domains.
- zx8080 1y agoProbably, it's cool, and honored inside an org to operate a separate domain service vs go ask for a permission for a subdomain to another team.
- JdeBP 1y agoInterestingly, the GitHub doco says outright that it superseded docker.pkg.github.com. ; so it was a conscious choice to go with this domain naming scheme instead of that one. * https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-docker-registry https://docs.github.com/en/packages/working-with-a-github-pa...
- rconti 1y agoinsecurity through obscurity
- dcrazy 1y agoIt’s best security practice to host user-generated content on a separate domain to opt into browsers’ cross-domain security policies. Hence ghcr.io, githubusercontent.com, fbimg.com, etc. https://www.reddit.com/r/webdev/comments/lg9xnm/why_do_some_websites_have_a_separate_domain_for/ https://www.reddit.com/r/webdev/comments/lg9xnm/why_do_some_...
- usr1106 1y agoNot a web programmer, so know cross-domain only for hearsay :( It does not seem to hinder e.g. Google using google.com, youtube.com, gmail.com, and several (many?) others to collect your data. Do you say security and privacy work differently here?
- Atreiden 1y agoFairly compelling attack vector because it took several readings for me to even see the problem with the domain.
- JdeBP 1y agoYou and many others. Including people who retry multiple times, and even reboot their machines. * https://stackoverflow.com/a/66985424/340790 https://stackoverflow.com/a/66985424/340790 (Spot the answerer's account name!) * https://forums.docker.com/t/docker-unable-to-push-to-ghrc-io-no-matter-what-i-try/144752 https://forums.docker.com/t/docker-unable-to-push-to-ghrc-io...
- a1o 1y agoDamn, this can pick a typo from a CI job and do mean things.
- aussieguy1234 1y agoThere are alot of open source projects using this domain https://github.com/search?q=ghrc.io&type=code https://github.com/search?q=ghrc.io&type=code
- notsahil 1y agoGitHub should a have tool internally to create bulk and send it as a fix
- aussieguy1234 1y agothey probably do, they already have one that identified credentials posted to github repos by accident.
- deleted 1y ago[deleted]
- michaeljhg 1y agohttps://github.com/advanced-security/secret-scanning-custom-patterns/blob/4ff454e67ba79e2f770f48f276ee24d3d037a8c2/uri/wrong_docker.sh https://github.com/advanced-security/secret-scanning-custom-...
- lathiat 1y agoThat's a fairly impressively sized list.
- engcoach 1y agoIs the danger here token replay? It's using Bearer tokens, so it's not sending a password over: <https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#authentication_schemes https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Aut...> Threats section for Bearer tokens: <https://datatracker.ietf.org/doc/html/rfc6750#section-5.2 https://datatracker.ietf.org/doc/html/rfc6750#section-5.2> Does OAuth reuse tokens across domains? If not, doesn't this just mean it is requesting an auth token for ghrc (the "fake" domain) but it can't access any auth tokens for ghcr (the real domain)?
- deleted 1y ago[deleted]
- bmitch3020 1y agoBlog author (and OCI maintainer) here. The request to get a bearer token sends the password or PAT using the basic auth header, base64 encoded, but otherwise clear-text. That's the request the www-authenticate header is triggering. Once the token is received, the registry uses that to verify access, and that eventually expires. But the attacker isn't getting the token, they are requesting the credentials that would be used to acquire a bearer auth token.
- iojcde 1y agohttps://github.com/search?q=ghrc.io&type=code https://github.com/search?q=ghrc.io&type=code
- nicce 1y agoGitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558 https://github.com/github/roadmap/issues/558
- echelon 1y agoSomeone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.
- jsheard 1y agoMicrosoft is paying top dollar for MarkMonitor, aren't they supposed to proactively register obvious typos so this kind of thing doesn't happen to their clients?
- VoidWhisperer 1y agoMy guess is that MarkMonitor is mainly used for their brand-relevant domains (microsoft, office 365, github (main site), etc), as opposed to one that a small subset of a small subset of their users of one service will use - I would imagine that microsoft likely owns hundreds of domain names and doesn't pay MarkMonitor to monitor every single one
- gruez 1y agoghcr.io is registered by markmonitor.
- TheDong 1y agoGood luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3193589914 https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platform or infrastructure team, and there's no chance in hell any email you send to microsoft or github will end up with that team ever. You won't have anyone to transfer the names to, you'll just be holding them and paying for them forever. The best thing you can do if you want to fix this is: 1. Don't make typos. 2. Email github and tell them to reserve typosquat domains, and know it will get ignored, or _maybe_ added to a backlog and ignored for at least the next 15 years 3. Don't make typos. 4. Don't use ghcr for anything, and always mirror public ghcr.io packages using a "bot" github account with only permissions to public repositories to minimize blast radius. Actually, the best bet to get this fixed is to wait for Microsoft to provide "Email Github Copilot support", hope that they hooked it up so the AI is capable of making purchase decisions, and convince it to purchase about 6000 domain names that might be typoes for security reasons.
- JdeBP 1y agoPreviously on Hacker News at https://news.ycombinator.com/item?id=44974240 https://news.ycombinator.com/item?id=44974240 .
- TZubiri 1y agoReminder not to use goofy TLDs, being cute is not worth it when compared to security. There's no guarantees that the process for taking down a malicious domain will be as smooth as a .com. I'd rather deal with US verisign rather than the British Indian Ocean territory or colombia or anguila
- bragr 1y agoThe .io TLD is administered by Afilias which is an American corporation.
- nicce 1y agoAfilias was sold to Ethos Capital and the whole domain is a mess: https://en.m.wikipedia.org/wiki/.io https://en.m.wikipedia.org/wiki/.io
- TZubiri 1y agoConfirmed: >$dig io >$dig a0.nic.io >$whois 65.22.160.17 OrgName: Afilias, Inc. OrgId: AFILI-2 Address: 10500 NE 8th Street City: Bellevue StateProv: WA PostalCode: 98004 Country: US
- gruez 1y agowhois says it's registered by dynadot, so it's probably worth contacting their abuse email: abuse@dynadot.com
- h3x0ne 1y agoalready happened :)
- usr1106 1y agoOne reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.
- _def 1y agoI couldn't find anything useful - what is a FLA?
- buzer 1y agoFour Letter Acronym probably. https://slang.net/meaning/fla https://slang.net/meaning/fla
- cperciva 1y agoFLA is an unusual way of writing XTLA (Extended Three Letter Acronym).
- usr1106 1y agoOf course I made it up, I assumed TLA is known as three letter acronym. Now ghcr has four of them...
- TobTobXX 1y agoOne reason why you should never think or say [or write] FLA, but always Four Letter Acronym (probably?), even if that is longer.
- deknos 1y agoWouldn't DNSSEC solve stuff like this?
- formerly_proven 1y agoHow?
- marcusb 1y agoNo.
- deleted 1y ago[deleted]
- hnngccf 1y agoI don't get it what is ghrc and why does it matter
- artursapek 1y agoNgl that's kinda badass
- juxhindb 1y agoHonestly using something like haveibeensquatted would catch _so_ many of these, including ability to submit takedowns.
- lacoolj 1y agolooks like it was either taken down or turned off. trying to run the same curl commands now just sits empty trying to access the IP curl -i -v https://ghrc.io/v2/ https://ghrc.io/v2/ * Trying 128.199.6.40:443...
- h3x0ne 1y agoNo seems back again