7 ms·

What was the purpose? Were the repositories private? Was the attack targeted toward known accounts working on new projects -- i.e., industrial espionage?

Fargren 13y ago
If you get a user-password combo, you can try it in more sensitive sites that may have stronger protection against brute force attacks. People reuse passwords a lot, specially the kind of users that use weak passwords on the first place. If the account has an email address connected to it, you can also try the password against the e-mail account. That can be worth quite a lot if it works.
- Wingman4l7 13y ago
  Ah yes, what with the usual "email address being the skeleton key to your online identity" and all. I keep forgetting about this, and find myself wondering why the heck people are phishing me for my LinkedIn account login.
rurounijones 13y ago
I just checked my security section (Didn't know about that!) and there were 12 attempts on my private, totally non-corporate, account. My password has not been reset by github but I have updated it anyway. On a sidenote I think that is a very clear and well written overview with clear details and a nice reminder about a section of the site that I was not familiar with.
- Wingman4l7 13y ago
  I just checked too (https://github.com/settings/security https://github.com/settings/security) and I had 6 attempts, all from unique IPs. Asked a friend of mine and he had 6 attempts (all from unique IPs) as well.
patio11 13y ago
I'm going to guess it was simple spray-and-pray. (My account took its fair share of compromise attempts, too, probably because I use the same username everywhere so it's going to be in many modern dev-heavy password dumps.) Github is, for better or worse, a high-value target these days. Compromise of a Github account will often get you credentials which you can use to compromise high-value targets, for example production machines. (Example from the Rails world: if someone gets read access to your git repository, expect them to figure out your secret token which you use for HMACing sessions to prevent forgery. If an attacker can forge sessions, they have remote code execution on your production servers. You can assume they will go directly from code execution to root on those servers, and from root on those servers to a systemic compromise of your entire network (if they want to do that).) Use your imagination on what a mass compromise of accounts gets you. The simplest possible example is grepping for /bitcoin/, finding the full source code and credentials for a Bitcoin exchange, and rooting them then emptying the hot wallet. That results in fairly obvious economic advantage, right? You could also use scriptable attacks to root thousands of big-n-beefy production machines on fairly trusted IP addresses, then add them to a botnet, which you'd use for spamming or various other nefarious activities. Then, even farther down the list, you have a dedicated adversary actually go through every repository they got access to and look for something uniquely fun to do with that particular target. If you were looking to do industrial espionage on a particular target, you'd probably pick a way that was less likely to be detected and cause a company-level security response. (Use passive recon to identify one or a few likely target email addresses, find one or a few likely passwords for them, and try them first. Heads you win, tails you just left evidence in a log of perfectly normal user behavior. You might follow up this perfectly normal user behavior with a social engineering attack.)
- Wingman4l7 13y ago
  Don't forget API keys in commits from users foolish enough to trust the security of private repos. Yeah, spear phishing / social engineering makes more sense for industrial espionage.
- tedunangst 13y ago
  Is there a setting I can change to turn off this "session -> code execution" feature?
borski 13y ago
From a Github email to a friend to whom this happened: "We have reviewed our logs and it doesn't appear that any actions were taken by the attacker other than to authorize the 'GitHub XRP Giveaway' application against your account. You should be able to find the OAuth events for that application in your account's security history: https://github.com/settings/security https://github.com/settings/security We do not believe that the application's authors were responsible for the break-in, rather that the attackers were attempting to game the giveaway. Ripple's explanation of the giveaway can be found here: https://ripple.com/blog/git-in-the-game-2020-xrp-giveaway-for-github-users" https://ripple.com/blog/git-in-the-game-2020-xrp-giveaway-fo...
- Wingman4l7 13y ago
  Wow... a botnet-orchestrated massive brute force attack to try and game a cryptocurrency giveaway? o.O The future was yesterday. As of this comment, 2020 RXP is worth ~ 0.03 BTC. Multiply by ~$500USD/BTC and you get ~$16 USD (over $20 when BTC was peaking $800+USD/BTC in the last couple days). Multiply that by the number of compromised accounts that meet the cutoff date criteria, and you get the take. Potentially some good money depending on your success rate, but maybe not worth the cost of renting a botnet?
  - alixaxel 13y ago
    They actually gave you an extra 2020 RXP if you star their repository (like I did). From the 3975 RXP I could send, it turned to ~85 USD the other day. Multiply that by 1698 and you get $167k. Pretty sure it was a win for them.
    - Wingman4l7 13y ago
      Ah, I misread that -- I thought it was if you had contributed to their repo, not simply starred it. I had left it out of the calculation for simplicity's sake as I figured most people would not have done that. Where did you get the 1,698 figure -- was that the number of accounts compromised?

Fargren 13y ago

If you get a user-password combo, you can try it in more sensitive sites that may have stronger protection against brute force attacks. People reuse passwords a lot, specially the kind of users that use weak passwords on the first place. If the account has an email address connected to it, you can also try the password against the e-mail account. That can be worth quite a lot if it works.

Wingman4l7 13y ago
Ah yes, what with the usual "email address being the skeleton key to your online identity" and all. I keep forgetting about this, and find myself wondering why the heck people are phishing me for my LinkedIn account login.

rurounijones 13y ago

I just checked my security section (Didn't know about that!) and there were 12 attempts on my private, totally non-corporate, account. My password has not been reset by github but I have updated it anyway. On a sidenote I think that is a very clear and well written overview with clear details and a nice reminder about a section of the site that I was not familiar with.

Wingman4l7 13y ago
I just checked too (https://github.com/settings/security https://github.com/settings/security) and I had 6 attempts, all from unique IPs. Asked a friend of mine and he had 6 attempts (all from unique IPs) as well.

patio11 13y ago

I'm going to guess it was simple spray-and-pray. (My account took its fair share of compromise attempts, too, probably because I use the same username everywhere so it's going to be in many modern dev-heavy password dumps.) Github is, for better or worse, a high-value target these days. Compromise of a Github account will often get you credentials which you can use to compromise high-value targets, for example production machines. (Example from the Rails world: if someone gets read access to your git repository, expect them to figure out your secret token which you use for HMACing sessions to prevent forgery. If an attacker can forge sessions, they have remote code execution on your production servers. You can assume they will go directly from code execution to root on those servers, and from root on those servers to a systemic compromise of your entire network (if they want to do that).) Use your imagination on what a mass compromise of accounts gets you. The simplest possible example is grepping for /bitcoin/, finding the full source code and credentials for a Bitcoin exchange, and rooting them then emptying the hot wallet. That results in fairly obvious economic advantage, right? You could also use scriptable attacks to root thousands of big-n-beefy production machines on fairly trusted IP addresses, then add them to a botnet, which you'd use for spamming or various other nefarious activities. Then, even farther down the list, you have a dedicated adversary actually go through every repository they got access to and look for something uniquely fun to do with that particular target. If you were looking to do industrial espionage on a particular target, you'd probably pick a way that was less likely to be detected and cause a company-level security response. (Use passive recon to identify one or a few likely target email addresses, find one or a few likely passwords for them, and try them first. Heads you win, tails you just left evidence in a log of perfectly normal user behavior. You might follow up this perfectly normal user behavior with a social engineering attack.)

Wingman4l7 13y ago
Don't forget API keys in commits from users foolish enough to trust the security of private repos. Yeah, spear phishing / social engineering makes more sense for industrial espionage.
tedunangst 13y ago
Is there a setting I can change to turn off this "session -> code execution" feature?

borski 13y ago

From a Github email to a friend to whom this happened: "We have reviewed our logs and it doesn't appear that any actions were taken by the attacker other than to authorize the 'GitHub XRP Giveaway' application against your account. You should be able to find the OAuth events for that application in your account's security history: https://github.com/settings/security https://github.com/settings/security We do not believe that the application's authors were responsible for the break-in, rather that the attackers were attempting to game the giveaway. Ripple's explanation of the giveaway can be found here: https://ripple.com/blog/git-in-the-game-2020-xrp-giveaway-for-github-users" https://ripple.com/blog/git-in-the-game-2020-xrp-giveaway-fo...

Wingman4l7 13y ago
Wow... a botnet-orchestrated massive brute force attack to try and game a cryptocurrency giveaway? o.O The future was yesterday. As of this comment, 2020 RXP is worth ~ 0.03 BTC. Multiply by ~$500USD/BTC and you get ~$16 USD (over $20 when BTC was peaking $800+USD/BTC in the last couple days). Multiply that by the number of compromised accounts that meet the cutoff date criteria, and you get the take. Potentially some good money depending on your success rate, but maybe not worth the cost of renting a botnet?
- alixaxel 13y ago
  They actually gave you an extra 2020 RXP if you star their repository (like I did). From the 3975 RXP I could send, it turned to ~85 USD the other day. Multiply that by 1698 and you get $167k. Pretty sure it was a win for them.
  - Wingman4l7 13y ago
    Ah, I misread that -- I thought it was if you had contributed to their repo, not simply starred it. I had left it out of the calculation for simplicity's sake as I figured most people would not have done that. Where did you get the 1,698 figure -- was that the number of accounts compromised?