[HN Gopher] GitHub comments abused to push malware via Microsoft...
___________________________________________________________________
GitHub comments abused to push malware via Microsoft repo URLs
Author : nateb2022
Score : 84 points
Date : 2024-04-20 14:55 UTC (8 hours ago)
(HTM) web link (www.bleepingcomputer.com)
(TXT) w3m dump (www.bleepingcomputer.com)
| lpapez wrote:
| Pretty standard stuff I would say.
|
| Back in the day when I worked in this field malware writers
| regularly used things like Youtube as blob-storage and Instagram
| comments as C2 server mechanism.
|
| Hiding in plain sight can be very effective.
| bitwize wrote:
| Back in the day, if your FTP server had ANY kind of
| vulnerability you could expect it to be filled with warez,
| mp3z, all sorts of shit.
| et-al wrote:
| I think the core issue is that anyone can easily create a URL
| for a file that looks like it was published by the Microsoft
| team.
|
| Instead, if Github uploads used the uploader's Github account
| in the URL path, scammers would need to resort to other means
| like punycode to mislead users.
| thih9 wrote:
| This seems simple to fix - deactivate all links that didn't
| become part of a published comment.
|
| I'm sure this is hard, especially at that scale - then again it
| seems doable eventually.
| mmoskal wrote:
| I guess easier to make the url be
| githubusercontent.com/whatever without mentioning repo name (or
| use uuid of repo).
| pquki4 wrote:
| What if a comment is updated to remove the link? Or maybe a new
| comment has no link, an edited version has a link, then the
| latest version removes link etc.
| sebazzz wrote:
| That's why you need to do garbage collection from time to
| time. That adds a lot of complexity to the system.
| gruez wrote:
| What if you make the hyperlink a dot or a zero width character?
| What if you place it adjacent to a legitimate link?
| hn_acker wrote:
| Can't you just comb through the HTML for the href? Then the
| text of the hyperlink doesn't matter.
| arp242 wrote:
| When do you do this? After an hour? A day? A week? There's been
| cases it's taken me a few days to write a comment or PR message
| because I was still working on things.
|
| If you set it to short (hours) it'll be pretty annoying and
| confusing for people. If you set it too long (more than a day),
| scammers will just keep generating new links.
|
| It's not that simple to fix, certainly not with these kind of
| timeouts. The only solution is to not have a "trusted" URL like
| that.
| SushiHippie wrote:
| Theoretically they could make links that are not posted in a
| comment private, and once you post the comment they would be
| made public.
| jabiko wrote:
| Or add a signed timestamp to the URL after which it isn't valid
| anymore. So the URL can't be used without opening the actual
| comment on GitHub.
| cute_boi wrote:
| I think file link shouldn't contain repo information like
| microsoft.
| Avi-D-coder wrote:
| The obvious fix is to remove the repo information, but do you
| grandfather in old files by redirecting to the new URL?
|
| I'd say no, which I guarantee will break some legitimate packages
| that depend on files uploaded in GitHub comments.
| pavel_lishin wrote:
| > _some legitimate packages that depend on files uploaded in
| GitHub comments_
|
| I love these one-sentence horror stories.
| TheCleric wrote:
| Depends might be a strong word but this would affect things
| like screenshots submitted in bug reports as well, which
| would be less than ideal at the very least.
| kevincox wrote:
| They could probably even just parse all comments and rewrite
| them. Then remove the redirects. If this feature is being used
| as intended these files should all be just linked to from
| comments and they parse the markdown anyways.
|
| While they are at it maybe they can expire some old files that
| aren't referenced...
| kevincox wrote:
| GitHub has githubusercontent.com. Why was this domain not used
| for these uploads? Or did image uploads in comments predate that
| domain?
|
| But either way putting the repo in the URL seems completely
| unnecessary. If you need to track ownership you can still do that
| in the backing database.
| captn3m0 wrote:
| Using the repo prefix allows them to put the same auth on
| uploads. So if you don't have access to a repo, you can't
| access files uploaded in its issues either.
| kevincox wrote:
| I'm not saying that they don't need to check auth by repo.
| They can still check the auth when they look up the metadata
| for the file. Just don't include it in the URL.
|
| The auth difficulty may make moving the files to a different
| domain more difficult, but same domain path shouldn't matter.
| chatmasta wrote:
| I could have sworn that githubusercontent _was_ used for these
| uploads. I'm not at my computer now so I can't double check,
| but I'm guessing there is some special case involved for these
| repos.
| Animats wrote:
| This is yet another example of hosting hostile content on an
| authoritative site. I still have a service running to track
| this.[1] It's a join of PhishTank and a somewhat dated list of
| major sites. Google is by far the worst offender. Hosting
| phishing sites in Google Sheets, etc. is not unusual. Yahoo and
| Microsoft used to be on that list, but they got better at kicking
| off hostile content. Adobe (via Adobe Express) has quite a few
| entries.
|
| [1] http://sitetruth.com/reports/phishes.html
| butterlesstoast wrote:
| I just attempted this myself by creating an issue, commenting a
| file, copying the link and not submitting the issue.
|
| It seems to work initially, but then 5m later the file gets
| deleted and the link leads to a dead s3 asset page.
|
| So I believe this is fixed. Though the solutions suggested below
| are crafty, trying to reproduce myself shows me this has been
| addressed by the GH team
| anste wrote:
| File links from comments should just live on a separate page.
| They should have nothing to do with the repo name or the
| organization.
___________________________________________________________________
(page generated 2024-04-20 23:01 UTC)