A Hacker is Wiping Git Repositories and Asking For a Ransom (zdnet.com) 213
An anonymous reader writes: Hundreds of developers have had had Git source code repositories wiped and replaced with a ransom demand. The hacker removes all source code and recent commits from vitcims' Git repositories, and leaves a ransom note behind that asks for a payment of 0.1 Bitcoin (~$570). The hacker claims all source code has been downloaded and stored on one of their servers, and gives the victim ten days to pay the ransom; otherwise, they'll make the code public.
Hundreds of users have had code repositories wiped and replaced with ransom notes. The coordinated attack has hit Git repositories stored across multiple platforms, such as GitHub, GitLab,and Bitbucket. Some users who fell victim to this hacker have admitted to using weak passwords for their GitHub, GitLab, and Bitbucket accounts, and forgetting to remove access tokens for old apps they haven't used for months --both of which are very common ways in which online accounts usually get compromised. Several users also tried to pin the issue on the hacker using an exploit in SourceTree, a Git GUI app for Mac and Windows made by Atlassian; however, there is no evidence to support this theory, for the time being.
Hundreds of users have had code repositories wiped and replaced with ransom notes. The coordinated attack has hit Git repositories stored across multiple platforms, such as GitHub, GitLab,and Bitbucket. Some users who fell victim to this hacker have admitted to using weak passwords for their GitHub, GitLab, and Bitbucket accounts, and forgetting to remove access tokens for old apps they haven't used for months --both of which are very common ways in which online accounts usually get compromised. Several users also tried to pin the issue on the hacker using an exploit in SourceTree, a Git GUI app for Mac and Windows made by Atlassian; however, there is no evidence to support this theory, for the time being.
So... (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3)
There is a price to pay for bad security. It is, unfortunately, not evenly distributed or people would probably learn. This way, you either get overlooked or you are hit catastrophically. The first one has not learning value, and the second one "only happens to other people" or "is not something you could have foreseen", so minimal learning value.
Re: (Score:2)
Re: (Score:2)
What single breach? each of these were separate cases of the developers incompetence.
The offline dictionary attack. A sign in protocol should be designed to prevent that.
Re: (Score:2)
I read it and the people 'admitting to having simple passwords' bit suggests a dictionary attack over scarfing.
Re: (Score:3)
Re: (Score:2)
In GitHub repo owners have the ability to force all linked accounts to use 2FA, which if the leaked passwords theory is accurate would have prevented this. Sure having a common cloud provider makes it easier to find multiple badly stored credentials, but on the other hand cloud providers usually have robust security options that may not be practical for a small company to implement on a self hosted solution.
Git *is* self-hosted (Score:2)
Git is self-hosted *by definition*.
Remember what the D in DVCS stands for.
Any workstation/laptop/whatever machine where "git clone" was run has a local copy of the history.
Thus any developer working on any project is also self-hosting their very own copy.
In theory devs could even keep working if Git Hub wasn't existing, just by pulling from each-other's machine.
(actually, the Linux kernel - to give a notorious example - has always been developed this way to begin with. Which is why Linus was interested in D
Re: (Score:2)
Do you actually know how DVCS works [wikipedia.org]?
DVCS always has a central repository considered the master copy, how on earth do you think it would work on a large software development project without one? Who has the latest version of master? Whose copy should I branch from? Who do I merge to? How do you make sure everyone is on the same version of the repo? Where do you do your continuous integration and builds from? How do you control which developer has access to which repo? How do you grant developers in other loc
Re: (Score:2)
He's not suggesting that you don't have a central repository that everyone checks in / out of. He's saying that if the central repo goes away, individuals still have copies from the last time they checked out master, which means you likely have a copy of master from before some shithead fucked with your repo, as well as the commit history.
You should be able to recreate the central repo from that, or any other branch that is close. It's essentially the same process as forking a repo.
Re: (Score:2)
But that's completely irrelevant to this thread, which is about the security of using cloud services vs having your own private service and not about how easy it is to restore a git repo.
It's not even central to the original story -
The hacker claims all source code has been downloaded and stored on one of their servers, and gives the victim ten days to pay the ransom; otherwise, they'll make the code public
Re: (Score:2)
Oh dear, another person who doesn't understand how git works [wikipedia.org].
Re: (Score:2)
This does not seem like a fallacy. Any author who has write access to an entire team's or company's git repositories can di a "git push origin ::master" and wipe the master. branch. Anyone who can delete the _original_ master on Github can delete all the direct clone repositories at Github, no matter who owns them, the way github handles forks. Even restoring that original repository from backup leaves all those clones deleted.
I'm not sure if Github has a way to restore this, but I've run into the problem m
Meh: It works bought ways (Score:2)
Git is distributed (*literally anyone* who has git-cloned a repository has a localcopy of the whole history. That's whole purpose of the D in DVCS), so therefore it works both ways.
yes anyone with stolen credentials can force-push and overwrite a repo with a ransom.
but any of the dev working on a project with admin rights can force-push again form their own ".git/" sub-directory on any workstation/laptop/deployment they work on the project and thus have a local clone.
any developer that has *no admin* right
Re: (Score:2)
Yes, I'm extremely familiar with git's working distribution system. But that "copy back" is not necessarily identical to what was deleted. If any clone has diverged, for example by infrequent merging, it will be obsolete and history may be lost. It may also _diverge_ due to added local operations, and those divergences may not be identical. Unplanned and even security damaging changes may be in any of the clones. Restoring those, without a good code review, can introduce quite old and dangerous merges.
>
Re: (Score:2)
Good thing I can choose to fetch and pull, yes? And I still have any branch on my local git repo regardless of what happens to master?
If anyone has a recent branch from master it should be annoying but very possible to recover.
Re: (Score:2)
So do you also write your source code repository code? Because there is nothing particular about cloud services in being vulnerable to this, merely using a remotely accessible git server is enough. As far as we know there is no use of vulnerabilities in Github or so.
Re: (Score:3)
Cloud or not, if you're working without a backup, you're a god damn idiot.
Oh, and someone could do this with on-prem git too, given public access. This is not necessarily a "cloud" problem.
Re: (Score:2)
Hows that whole cloud thing working out for you? Sux2bu, but not surprised at the results.
To be clear your through process is: User too dumb to use strong password / not expose security access tokens online for all to use, apparently has a solid backup and recovery process as part of a well thought out business continuation strategy?
How well is it working out for them? Well apparently after 10 days they get their source code back, so I would consider this a win for the cloud over the alternatives.
If you use GIT, and this is a problem (Score:5, Insightful)
.. then you aren't using GIT, the /distributed/ source control system correctly.
Re: If you use GIT, and this is a problem (Score:2)
Though the code itself should be safe, it might be really annoying if the "hacker" runs amok in the project and deletes all the metadata (issue tracker, discussions, wiki, etc.) on the hosting site.
Re: (Score:3)
it might be really annoying if the "hacker" runs amok in the project and deletes all the metadata (issue tracker, discussions, wiki, etc.) on the hosting site.
If so, then it would indicate you made a mistake by using a hosting site that does not let you archive your project metadata offsite.
Re: (Score:2)
Or have backups of any sort.
Re: If you use GIT, and this is a problem (Score:5, Informative)
Did anyone here read the actual article above? The hacker isn't insinuating in any way whatsoever that he has the only copy of the code. His threat is that he'll release the code publicly unless he gets paid.
Re: (Score:2, Offtopic)
Their code must be _terrible_.
Career ending for it to be seen.
Nobody cares to look at 99.999% of code. Generally we're going to have seen worse, want to get paid for reviewing someone else's mess.
Re: (Score:2)
Probably the opposite, actually. He could just claim he's hacked the repository and has a copy of the code, but most anyone would just blow it off as an empty threat from some nitwit. By deleting the contents of the repository he demonstrates that he's actually hacked into the repository and thus it's likely he does actually have a copy of the contents he could release.
Re: (Score:3)
I said it before and I'll say it again: stop making red apps!
Re: (Score:2)
1. Git is not owned by Microsoft. You don't know what you are talking about. You probably meant GitHub (which makes use of git), but even then Microsoft still operates Azure DevOps (cloud-hosted Team Foundation server) as well as sells Team Foundation Server at the same time that GitHub sells GitHub Enterprise. It is very clear that the purchased GitHub unit operates fairly independently under the Microsoft umbrella.
2. Their ownership of GitHub has exactly the square root of jack shit to do with open-so
Re: (Score:2)
Why wouldn't you just push back to master from one of your trusted developers that undoubtedly has master on his laptop?
Hey look, you don't need to vet it because you can look at the commit history and see if any bullshit was put in from the last known-good date. It's almost like git has this built in.
Re: If you use GIT, and this is a problem (Score:4, Insightful)
If you have those offline copies, then why would you even bother needing the attacker to 'return' the code?
Re: If you use GIT, and this is a problem (Score:5, Informative)
The attackers aren't threatening deletion, they are threatening public release of source code.
I worked for a company that debated going open source. Several people strong objected to "giving away the crown jewels". But we decided to open it up, and release the code. A year later, we checked the server logs, and found it had been downloaded this many times: 0.
What many companies don't realize, is that no one, not even their competitors, wants their code. They are way too busy trying to understand and fix their own code. They don't have time to waste trying to understand yours.
Re: (Score:2)
Re: If you use GIT, and this is a problem (Score:2)
Why did you pay them? Why didn't you just claim breach of contract?
Re: If you use GIT, and this is a problem (Score:2)
Not to mention how much nicer it is to not setup private repos for software version management and distribution. Getting to just publish your code somewhere nice and easy to install from using open source tools is a killer feature of open sourcing your code.
Re: (Score:2)
*especially* not their competitors. The last thing any company wants is a successful product that get sued to oblivion for stealing code.
Re: If you use GIT, and this is a problem (Score:2)
Good ole' security by obscurity
Re: (Score:2)
I believe if your code was doing something groundbreaking that no one else had yet been able to accomplish than perhaps the story might be a little different.
If you are smart enough to write ground breaking code, then you are likely smart enough to secure your git repo.
Re: If you use GIT, and this is a problem (Score:2)
Why do you put trusted data on machines built with CPUs you don't control? They might have backdoors. You're opening yourself up to unnecessary risk by not rolling your own chip foundry.
Re: If you use GIT, and this is a problem (Score:2)
This is a non-sequitur. There is still no reason to store it somewhere out of your control.
Re: (Score:2)
There is still no reason to store it somewhere out of your control.
If you use reasonable security, it isn't out of your control.
If you do not use reasonable security, it will be out of your control regardless of who owns the server.
Re: (Score:3)
publication threats (Score:2)
*if* your secret code is so precious that publishing it would damage your company, then you shouldn't be hosting it on somebody else's servers to begin with.
Hosting *local* copies of GitLab is damn easy.
Re: If you use GIT, and this is a problem (Score:2)
You are assuming every project is in active development. Some projects have valuable code but go into periods of stasis during which GitHub might end up your only copy, unless you've specifically planned for this with backups.
Re: If you use GIT, and this is a problem (Score:2)
Internet tough guy.
what's the problem? (Score:2, Insightful)
git isn't my repo - it's a copy of my repo.
All I have to do is reinstrument the repo and I'm good.
Isn't that what git is all about...?
CAP === 'modernly'
Re:what's the problem? (Score:5, Informative)
Read the article again (or for the first time.) The hacker is demanding payment or he will release the code publicly. In no way does the hacker claim he has the only copy of the code, that would be ridiculous.
Re: (Score:3)
Ah cool, so some people with bad passwords storing their super secret code on the Internet might get it leaked. The horror.
Re: (Score:2)
The hacker is demanding payment or he will release the code publicly.
So he's a sweetie. Hang him from the yardarm anyway.
Worst blackmail evar (Score:3)
The hacker is demanding payment or he will release the code publicly.
Most companies code isn't worth the zeros its comprised of. I wouldn't give this yahoo two cents - he can publish the code but who would even care to look at it?
You can lead a horse to a sewer but he's not even going to think about drinking.
If I got that notice my only action would be to refresh any API keys that might be in there (which you'd have to do anyway even if you paid the guy). Cost: $0.00 (USD).
Re: (Score:2)
Re: (Score:3)
> Most companies code isn't worth the zeros its comprised of.
Some company code has embedded login passwords, database passwords, SSH keys, AWS keys, copyright violations, and outright intellectual property theft.
Stupid Move (Score:3)
Re: (Score:3, Insightful)
Re: (Score:2)
If a code leak will kill your business, you might be doing it wrong.
Should we make RSA encryption algorithms proprietary? No, this would hurt security, not help it.
A company's code is simply an expression of what it needs to run its business. More than likely, leaking the code wouldn't truly hurt the business, unless exposure would show vulnerabilities they don't want others to see.
Wait, maybe that's the real problem here!
Yet another advantage of... (Score:2, Insightful)
Re: (Score:3, Insightful)
So pointing out the shining flaw of cloud computing is Troll material? Pathetic.
Yes, ownership matters. Cloud is just a way of shirking responsibility. Someone else's problem. Cloud Thing blew up and your users are screaming? "Bruh, cloud's down, nothing we can do for now"
Typical. Either a couple of corporate shills modded you down, or dew-eyed misguided idealists did.
Re: (Score:3)
Cloud computing is saying "I can't do this, and I don't want to figure it out, so let someone else handle it for me" for things like security. Problem is, particularly with security, most of the problem is the user anyway.
Re: (Score:2)
Sure. So you outsource your security to the cloud, and they make sure the servers are configured securely and train all your people in proper security procedure, right?
You might get the first, if you're lucky. And that's the smaller part of the job.
Re:Yet another advantage of... (Score:5, Funny)
Typical. Either a couple of corporate shills modded you down, or dew-eyed misguided idealists did.
Speaking as a misguided corporate idealist dew-eyed shill, I resent your attempt to categorize me as either one thing or another. I am magnificent in my complexity.
Re: (Score:2)
So pointing out the shining flaw of cloud computing is Troll material? Pathetic.
No. Blaming the cloud for what amounts to stupid users when the cloud is neither the source nor the solution to the problem is worthy of a "troll" mod. Pathetic is those people who think the kind of idiots that got into this mess wouldn't be in the same position without the cloud (I'd put my money on either a dev server being open public to the internet from their networks, or someone never checking if their backup script actually backs up anything).
Re: (Score:3)
But, isn't the idea that git duplicates code you have locally, and the web version only changes with your approval? And even if the web version were to completely change or disappear, you'd still have the local version unless you did a "pull sync" which copied the web changes to the local code? And, there's no reason to do a "pull sync" unless you're consciously accepted change
Re: (Score:2)
Re: (Score:2)
"pull sync"
What you did was failed to read even the summary at the top of this page....
Oh stop it. Parent quoted "pull sync".
1) They obviously missed the critical part, glad you filled them in. But quit with the insults. They freely admit they're in the deep end.
2) Why is there not a mod for "+1 cute"? As a frequent git user, I love/can't stop laughing at the "pull sync" quote. Probably because I have Stockholm syndrome and "love" git so much.
Re: (Score:2)
It's more yours using the cloud than it is storing it at home. Or are you somehow implying that the Venn Diagram of idiots who can't use a proper password / protect their security tokens and idiots who don't have a functioning backup / business continuity strategy isn't massively overlapped?
This as usual shows that the "cloud" is perfectly safe, but it doesn't fix stupid users. Those same stupid users would be the ones that run backups and never check that they work, or expose their dev server on the intern
Re: (Score:2)
Git exists in a Azure cloud... this part of the cloud isn't open to the public, but the user has no clue where the server is.
I'm not affected. (Score:5, Insightful)
The hacker claims all source code has been downloaded.
$600 is cheap to recover your code (A: where's your backups? B: Now's a good time to think about making it public.)
But *IF* I was going to pay, the first thing I'd email back (if possible) is: I don't believe you. Give me two random files of mine, each over 1,000 lines. Otherwise, NO.
And: thanks for the security reminder! I'll do better in the future!
Re: (Score:3)
If he can overwrite your 'private' git repository, then I would have no reason to doubt that he could have *read* from that same repository.
Re: (Score:2)
If he can overwrite your 'private' git repository, then I would have no reason to doubt that he could have *read* from that same repository.
My git repository is write-only, you insensitive clod!
- alternative response -
HA! I'm still using CVS!
Re: (Score:2)
Actually, a lot of ransomware in the past could delete or encrypt your date, but could not get it back. This person may have deleted repos without keeping copies and the threat may be empty. Too many people will not verify this and pay anyways.
Re: (Score:3)
But *IF* I was going to pay, the first thing I'd email back (if possible) is: I don't believe you. Give me two random files of mine, each over 1,000 lines. Otherwise, NO.
That would only prove is the hacker has the files intact.
As they had write access, they had read access too, so there is little reason to not believe they have the files.
What I wouldn't believe is if they will give them all back after being paid.
They can still provide a couple files in advance, then ignore you once they get your money.
So if they actually didn't copy anything, that would certainly call them out on it.
But in either case it doesn't really boost any amount of trust that they will still return e
Re: (Score:2)
Don't forget though, your code has been in the hands of a known bad guy at that point. You can't trust it.
Blackmail has no half life (Score:4, Funny)
git push? (Score:2, Insightful)
Kids these days... These script kiddies simply do not understand how git works. If some clown compromises github and wipes my repository, and I get this silly a ransom note, what's to stop me from simply pushing to another git repo elsewhere, like gitlab, sourceforge, or pagure? Presto -- the git repository gets instantly restored.
Everyone who has cloned a git repo has a complete copy of the repo, that can be pushed anywhere, at a moment's notice.
Re: (Score:3)
So your reading comprehension is lack. Please re-read the article and understand the threat. Here, I will help you, the threat is releasing the code in the wild and not stealing of the code.....sheesh. More than likely, they are only going after business accounts.
Re: (Score:3)
So what is the point of trashing the repos?
I guess to let you know that they really do have access to the repository.
It's a bit concerning that these high profile hosting platforms allow trashing of the repository by default. Personally for all the repositories that I manage for my company, any push that rewrites history is blocked, so the only way to accomplish this is with direct filesystem level access to the server holding the repository.
Comment removed (Score:3)
Re: (Score:2)
You don't even need a backup in this case. You (and everyone who works on this code) already have a clone of the repo on your machine, that's how git works!
Re: (Score:2)
Re: (Score:2)
If I may quite a colleage: "You don't get out much, do you?" There are many "serious developers" who have no idea of assuring the history and changes to their code, and many are blocked from discussing it by the strict responsibilities enforced by task segregation in their workgroups.
Re: (Score:2)
What makes you think someone who can't use a strong password / protect access tokens to their git repository knows how to take a bi-weekly air-gapped backup?
Baffling (Score:2)
This is a problem?
Why are you hosting your code elsewhere if you don't want it public?
Why are you not securing it with basic protections (a strong, unique password)?
Why do you not have a local copy?
Re: (Score:2)
This is a problem?
Why are you hosting your code elsewhere if you don't want it public?
Sometimes it makes more sense to have a 3rd party handle your repo. Not every team wants to maintain their own server with a publicly accessible IP address.
Why are you not securing it with basic protections (a strong, unique password)?
If I am understanding the piece correctly, the hack involved finding publicly visible developer git client auth information. So probably people sharing directories and not realizing there were hidden files with information that could be used to access the repo.
Why do you not have a local copy?
It sounds like the threat was to release private code rather than delete the repo. Even wit
I think you've said too much. (Score:2)
Hundreds of developers have had had Git source code repositories wiped and replaced with a ransom demand ...
Can he wipe out extra verbs?
Wait, wait, let me guess... (Score:2)
The hacker claims all source code has been downloaded and stored on one of their servers, ...
They call their repository: Got
Goddamn guys... (Score:2)
To everyone that posted something along the lines of, "OMG dude, why would anyone pay this ransom? Like, he could just re-upload the code, yo."
This is referred to as being, "the fool that rushes in". If you ever read something that sounds just so totally absurd that you instantly see stupid everywhere, maybe re-read, or re-think the situation, please.
Re: (Score:2)
Indeed. This used to be a place for nerds. Now it looks like a bunch of underachievers lacking reading comprehension skills.
Re: (Score:2)
Did you mean (Score:2)
Haha (Score:2)
The wallet is practically empty
I am going to crap my pants (Score:2)
Backups? (Score:2)
It seems like every single individual has to learn the hard way, at least once: Backups. Different kinds of backups, Online and offline backups. Automated backups, so that you don't have to remember to do it yourself - only: do check periodically that the automatic process hasn't broken. And the offsite stuff does require feet.
Errrrrm, ... I think he doesn't understand Git (Score:2)
It's Git. It's distributed. That's the whole point. He has a copy of the history - so effing what? In the words of Vincent Hanna: "I am over-f*cking-welmed." [youtube.com]
Anyway, I thank him for giving us a free lesson in being more careful about credentials in repos.
Re: (Score:2)
The problem is that you don't understand the *story*.
The threat here is public release of the code, not deletion. Deleting it was just to get peoples attention.
Thank you, Microsoft (Score:2)
Re: (Score:2, Redundant)
Can't believe how many people didn't even read the article. The hacker is demanding payment or else he'll release the code publicly. In no way does he claim/think he suddenly has the only copy.
Half the commenters don't read the summary (Score:2)
> Can't believe how many people didn't even read the article.
This surprises you? I've noticed many of the people who comment here on Slashdot obviously don't read the *summary*. It's clear many only glance at the headline. They then comment. Scarily, one can only assume that for them, voting is the same way - glance ar a headline and that's all they nees to know.
Re: (Score:2)
You have to admit that the headline is wildly misleading. When I read the headline, that was exactly the first thing I thought of as well. "Hacker infiltrates private repositories, threatens public release" or something similar would immediately convey that he was accessing things not meant to be shown to the public. "Wiping the repository" does nothing except indicate that he gained admin access.
Well, it's not like I wouldn't expect a site like ZDNet to misunderstand the important bits of this story whe
Re: (Score:2)
I Can't Believe It's Not Butter!
Re: (Score:2)
Yes anyone who's checked out the code has a copy of the code, so chances are several developer workstations have copies of the code...
Which is why the attacker is not threatening to remove the code, he is threatening to publish it. He only deleted the repository so people would notice his random note, otherwise the ransom note would go unnoticed amongst all the other files present in the repository.