{"id":4722,"date":"2024-01-05T14:07:49","date_gmt":"2024-01-05T14:07:49","guid":{"rendered":"https:\/\/gitprotect.io\/blog\/?p=4722"},"modified":"2024-08-08T12:21:52","modified_gmt":"2024-08-08T12:21:52","slug":"2023-in-review-infamous-github-related-incidents-and-threats","status":"publish","type":"post","link":"https:\/\/gitprotect.io\/blog\/2023-in-review-infamous-github-related-incidents-and-threats\/","title":{"rendered":"Infamous GitHub-related Incidents And Threats: 2023 in Review"},"content":{"rendered":"\n

How will the cybersecurity landscape change in 2024? Will it become safer or more dangerous? We can guess, make predictions\u2026 or just wait a bit and see\u2026 However, to move forward and make some assumptions first we need to look back at the past. The following article is the first in a series of this type where we\u2019ve decided to dig into DevOps-related \u201cfackups\u201d. <\/p>\n\n\n\n\n\n\n\n

Let\u2019s today take a look at GitHub-related infamous incidents, including outages, high-severity flawss, and malicious attacks. Do you still consider backing up your GitHub data or not? Let us help you make up your mind. <\/p>\n\n\n

\n
\"GitHub<\/figure><\/div>\n\n\n

DECEMBER 2023

GitHub Status info: 10 incidents <\/strong><\/p>\n\n\n\n

Hackers abuse GitHub to avoid detection & control compromised hosts<\/h2>\n\n\n\n

Researchers from ReversingLabs noticed<\/a> that threat actors started using GitHub for their malicious purposes and reported that \u201clately, we have observed the increasing use of the GitHub open-source development platform for hosting malware<\/em>.\u201d The novel methods that the malicious actors use include leveraging secret Gists and issuing malicious commands via git commit messages. So, the trick is that they can host their malware on a legitimate public service and use it as a dead-drop resolver to retrieve the real command-and-control (C2) address. <\/p>\n\n\n\n

These sneaky techniques permit hostile actors to conceal their malicious network traffic inside of legitimate communications on a compromised network. In this case, it\u2019s difficult to identify and address the threats quickly and effectively. Consequently, the infected endpoint corresponding with a GitHub repository may not be reported as a suspicious one, giving a threat actor the green light to create an attack infrastructure that\u2019s reliable and inexpensive, and threaten other users and their data. <\/p>\n\n\n\n

The Hacker News<\/a><\/p>\n\n\n\n

15K Go Module Repos on GitHub are vulnerable to RepoJacking attack<\/h2>\n\n\n\n

GitHub RepoJacking<\/a> has been threatening GitHub users for a while, however, in 2023 it has always been on the tip of the tongue. Researchers from AquaSec concluded that 9 million repos can be vulnerable to RepoJacking (we will look at this case further), the Checkmarx team discovered<\/a> that GitHub\u2019s vuln could have exposed over 4K packages to RepoJacking attacks, and recently VulnCheck had been investigating this issue and found out that over 15K Go module repos are vulnerable to this kind of an attack. <\/p>\n\n\n

\n
\"\"<\/a><\/figure><\/div>\n\n\n

It\u2019s worth mentioning that Go programming language modules are particularly vulnerable to RepoJacking as, in contrast to other package manager solutions, including npm packages<\/a> or PyPI, they are uploaded to version control systems, like GitHub or Bitbucket. <\/p>\n\n\n\n

In its research, VulnCheck stated<\/a> that: <\/p>\n\n\n\n