Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
GitHub: How stolen OAuth tokens helped breach dozens of orgs

GitHub: How stolen OAuth tokens helped breach dozens of orgsPost Views: 34
Premium Content

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
GitHub has shared a timeline of this month’s security breach when a threat actor gained access to and stole private repositories belonging to dozens of organizations.
The attacker used stolen OAuth app tokens issued to Heroku and Travis-CI to breach GitHub.com customer accounts with authorized Heroku or Travis CI OAuth app integrations.

GitHub’s Chief Security Officer Mike Hanley says the company has yet to find evidence that its systems have been breached since the incident was first discovered on April 12th, 2022.

GitHub is still working on alerting all impacted users and organizations, with the company being in the process of sending the final notifications to affected GitHub.com users as of today.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
An analysis of the attacker’s behavior, while he had access to compromised Github accounts, shows that the following activities were carried out on GitHub.com using the stolen OAuth app tokens:

1. The attacker authenticated to the GitHub API using the stolen OAuth tokens issued to Heroku and Travis CI.
2. For most people who had the affected Heroku or Travis CI OAuth apps authorized in their GitHub accounts, the attacker listed all the user’s organizations.
3. The attacker then selectively chose targets based on the listed organizations.
4. The attacker listed the private repositories for user accounts of interest.
5. The attacker then proceeded to clone some of those private repositories.

“This pattern of behavior suggests the attacker was only listing organizations in order to identify accounts to selectively target for listing and downloading private repositories,” GitHub said.

“GitHub believes these attacks were highly targeted based on the available information and our analysis of the attacker behavior using the compromised OAuth tokens issued to Travis CI and Heroku.”
See Also: Cisco vulnerability lets hackers craft their own login credentials Finding evidence of malicious activityGitHub disclosed the breach on the evening of April 15th, three days after discovering the attack, when the malicious actor accessed GitHub’s npm production infrastructure.

In the initial stage of the attack, the threat actor used a compromised AWS API key acquired after downloading multiple private npm repositories using stolen OAuth user tokens.

While GitHub, Travis CI, and Heroku have revoked all OAuth tokens to block further access after discovering the attack, affected organizations are advised to keep monitoring their audit logs and user account security logs for potentially malicious activity linked to this incident.

GitHub shared the following guidance with potentially impacted customers to help them investigate logs for evidence of data exfiltration or malicious activity:

* Review all your private repositories for secrets or credentials stored in them. There are several tools that can help with this task, such as GitHub secret scanning and trufflehog.
* Review the OAuth applications that you’ve authorized for your personal account or that are authorized to access your organization and remove anything that’s no longer needed.
* Follow GitHub’s guidelines for hardening the security posture of your GitHub organization.
* Review your account activit[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

GitHub: How stolen OAuth tokens helped breach dozens of orgs | Black Hat Ethical Hacking

GitHub has shared a timeline of this month's security breach when a threat actor gained access to and stole private repositories belonging to dozens of organizations.

10 viewsedited 09:50

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking GitHub: How stolen OAuth tokens helped breach dozens of orgs GitHub: How stolen OAuth tokens helped breach dozens of orgsPost Views: 34 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png…

y, personal access tokens, OAuth apps, and SSH keys for any activity or changes that may have come from the attacker.
* Additional questions should be directed to GitHub Support.

You can find more info on how GitHub responded to protect its customers and what organizations need to know in the initial security alert. See Also: Offensive Security Tool: KeeThief Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Write up: How to schedule tasks the right way in Linux, using crontab
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Figure-6-Our-exploit-implemented-and-winning-the-TOCTOU-race-90x90.png New Nimbuspwn Linux vulnerability gives hackers root privileges1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-6-90x90.jpg Lapsus$ Hackers Target T-Mobile2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-5-90x90.jpg Log4Shell vulnerability in AWS allows full host takeover3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/New-Java-Framework-Vulnerability-and-Mitigations-90x90.jpg Java encryption implementation error made it trivial to forge credentials1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-3-90x90.jpg CISA warns of attackers now exploiting Windows Print Spooler bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-3-90x90.jpg Newly found zero-click iPhone exploit used in NSO spyware attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/2b93-article-220121-cisco-90x90.jpg Cisco vulnerability lets hackers craft their own login credentials1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/windows-patch-update-90x90.jpg Microsoft Zero-Days, Wormable Bugs Spark Concern2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-2-90x90.jpg Git security vulnerabilities prompt updates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload2 weeks ago
The post GitHub: How stolen OAuth tokens helped breach dozens of orgs first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

10 viewsedited 09:50

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
At March Lapsus$ breached Nvidia, with both Microsoft and Okta disclosing data thefts by the group in the last several days. Here are the details of the attacks

submitted by /u/blakewarburtonc
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

At March Lapsus$ breached Nvidia, with both Microsoft and Okta...

Posted in r/hacking by u/blakewarburtonc • 1 point and 0 comments

6 viewsedited 10:36

About

Blog

Apps

Platform