9 ms·
Please be careful when revoking tokens. It looks like the payload installs a dead-man's switch at ~/.local/bin/gh-token-monitor.sh as a systemd user service (Li
by cube00 5mo ago
Please be careful when revoking tokens. It looks like the payload installs a dead-man's switch at ~/.local/bin/gh-token-monitor.sh as a systemd user service (Linux) / LaunchAgent com.user.gh-token-monitor(macOS). It polls api.github.com/user with the stolen token every 60s, and if the token is revoked (HTTP 40x), it runs rm -rf ~/.
https://github.com/TanStack/router/issues/7383#issuecomment-4425225340 https://github.com/TanStack/router/issues/7383#issuecomment-...
- fragmede 5mo agoOne should always have had backups configured, but if this is what gets people to setup backups, so much the better.
- eqvinox 5mo agoSure. But even restoring from backup means a cost is being inflicted, and not a small one.
- bpavuk 5mo agoif so, then this is actual terrorism of the software world!!
- embedding-shape 5mo agoOnly if the goal is to actually spread fear in a civilian population. It's not clear what the motivation is here besides "the worm spreads itself lol".
- bpavuk 5mo agothat dead man's switch surely smells like that tbh
- isityettime 5mo agoThe dead man's switch reminds me of worms and viruses from my childhood, whose primary purpose was apparently just to wreak havoc rather than direct financial gain. It's a childish gimmick.
- resonious 5mo agoIf an infected computer gets disabled after deactivating one stolen credential, it might slow down the victim from deactivating their other stolen credentials.
- isityettime 5mo agoUgh. True.
- meander_water 5mo agoI don't understand why people were voting this comment down in the issue page
- deleted 5mo ago[deleted]
- bpavuk 5mo agobots. the GitHub bot law: the GitHub bot situation is way worse than you imagine even if you are aware of the GitHub bot law. yes, a cheap parody on Hofstadter's law, but that's how bad it is
- sieabahlpark 5mo ago[dead]
- skissane 5mo agoMaybe they have a non-standard interpretation of thumbs-down – as "thumbs-down to this fact" not "thumbs-down to you for pointing it out"
- hmokiguess 5mo agoI have noticed this behaviour happening more often too, it's very confusing. Usually when texting with younger Gen Z people.
- efilife 5mo agoThis has always been happening
- Griffinsauce 5mo agoWe lived through a generation of agism at millennials and now we're turning around and doing it at Gen Z. It's unbelievable.
- dcchambers 5mo agoIncredible. Mutually assured destruction. The next five years are going to be truly WILD in the software world. Air-gapped systems are gonna be huge.
- NSUserDefaults 5mo agoMaybe just ai-gapped.
- eqvinox 5mo agoIs that an offhanded joke on the terminology or do you actually mean something? I can't tell.
- Gigachad 5mo agoRealistically if you have installed malware, you need to do a full wipe of your computer anyway.
- eqvinox 5mo ago[On Linux:] If you didn't give yourself "free" (passwordless) sudo, that's not necessary… …unless it happened in a week with 2 and a half Linux kernel LPEs.
- dgellow 5mo agoYou should assume other LPEs exist though
- Gigachad 5mo agoOn linux realistically whatever user you installed the malicious NPM package with has access to everything you care about anyway.
- lrvick 5mo agoEvery user, since privesc is so easy on most operating systems.
- deleted 5mo ago[deleted]
- corvad 5mo agoI'm not quite sure of what this really accomplishes, like is it just M.A.D.? Like at that point the creds have been stolen and the whole machine is toast.
- dominicm 5mo agoEven after the owner has realized the attack and revoked the token, there’s next steps (alerting the community, pulling from NPM) that causing havoc delays even by just a bit.
- avaq 5mo agoThe point is to dissuade mass token revocations. Let's say the attack becomes hugely succesful and the worm spreads to thousands of devices. GitHub/NPM could just revoke all compromised tokens (assuming they have a way to query) stopping the worm in its tracks. But because of the Dead Mans Switch, they'd know that in doing so, they'd be bricking thousands of their user's devices. So it effectively moves the responsibility to revoke compromised tokens from a central authority that could do it en-masse, to each individual who got compromised, greatly improving the worm's chances of survival.
- frikk 5mo agobrilliant. thank you for that.
- shevy-java 5mo ago> as a systemd user service Hah! I know why I don't use systemd.
- deleted 5mo ago[deleted]
- petcat 5mo ago> I know why I don't use systemd Could just as easily install it in your user's crontab though?
- k33P1Tr3aL 5mo agoSounds like MSFT should update the WAF to look for this polling and just return 200 or some other code until resolved, then cycle the tokens.