A hacker is wiping Git repositories and asking for a ransom

[PX4XKkRWMM]

Another example why you should not use plaintext passwords in configuration files. "All evidence suggests that the hacker has scanned the entire internet for Git config files, extracted credentials, and then used these logins to access and ransom accounts at Git hosting services." So luckily no technical flaw seems to be used but simply the human flaw of bad security practices probably due to laziness. At least I personally would expect laziness to be the main underlying reason.

 

On GitHub, GitLab and Bitbucket hundreds of git repositories have been tacking "hostage" by a hacker who deleted/corrupted/altered code and recent commit history of those repositories and left a ransom demand for "0.1 Bitcoin (~$570)". The ransom note reads:

Quote

To recover your lost code and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA and contact us by Email at admin@gitsbackup.com with your Git login and a Proof of Payment. If you are unsure if we have your data, contact us and we will send you a proof. Your code is downloaded and backed up on our servers. If we dont receive your payment in the next 10 Days, we will make your code public or use them otherwise.

A search on GitHub done by ZDNet revealed "that at least 392 GitHub repositories have been ransomed, so far". The same search just now yields 384 results.

 

The article on ZDNet also speaks of a way to recover: "members of the StackExchange Security forum have found that the hacker does not actually delete, but merele alters Git commit headers, meaning code commits can be recovered, in some cases."

Also of course if you have a local clone of the repository which was up to date with the repository that has been compromised you can simply recover from there.

 

And finally, while it might be not to difficult to restore your repository and close the security holes the ransom notes also threatens with making the code public, "private Git repositories were most likely compromised as well", which could still could be a mayor problem for those affected.

 

 

Original article at ZDNet; https://www.zdnet.com/article/a-hacker-is-wiping-git-repositories-and-asking-for-a-ransom/

Some interesting links from the article:

The GitHub search: https://github.com/search?o=desc&q=1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA&s=indexed&type=Code

Related StackExchange posting, partially quoted by ZDNet and contains instructions on how to recover: https://security.stackexchange.com/questions/209448/gitlab-account-hacked-and-repo-wiped

 

[Derrk]

3 minutes ago, PX4XKkRWMM said:

"All evidence suggests that the hacker has scanned the entire internet for Git config files, extracted credentials, and then used these logins to access and ransom accounts at Git hosting services." 

it must've taken some time to scan the entire internet

[Master Disaster]

I once heard a policeman say that even though it's his job to catch criminals even he has to admit that sometimes they display a certain amount of ingenuity when coming up with these activities.

 

You kind of have to agree with him.

[RejZoR]

12 minutes ago, Derrk said:

it must've taken some time to scan the entire internet

Is his name Chuck Norris by any chance? Coz only he knows the entire internet.

[Master Disaster]

13 minutes ago, Derrk said:

it must've taken some time to scan the entire internet

[Derrk]

2 minutes ago, RejZoR said:

Is his name Chuck Norris by any chance? Coz only he knows the entire internet.

 

1 minute ago, Master Disaster said:

Not sure if you seen this, but it makes me think of the Discover credit card commercial where they say they "triple scanned the dark web" to see if your social security number comes up 

[RejZoR]

Well, Chuck Norris doesn't need disk space, he just memorizes entire internet.

[WereCatf]

16 minutes ago, Master Disaster said:

I once heard a policeman say that even though it's his job to catch criminals even he has to admit that sometimes they display a certain amount of ingenuity when coming up with these activities.

Ingenuity and creativity are ingenuity and creativity, no matter what they're used for.

[NunoLava1998]

Wrong; it's the UK police erasing people's repositories if they don't have a Git loicense.

[lewdicrous]

Microsoft has a gold mine on their hands, they better beef up the security..

[WereCatf]

I do have several projects on Github, but they're all public already. Also, I run my own git-server as well, with copies of all the repos on my github-account. I do quite like git for what it is and I find it really powerful.

[colonel_mortis]

Of all the things to random, a git repository must be one of the stupidest things you could choose. The entire point of a git repository on something like GitHub is that you have a local copy that you synchronise with GitHub, so one git push -f later and you're back up and running.

There will obviously be some repos that weren't synchronised, or branches that people want to recover, but on the whole this seems like a lot of effort for not much gain.

[mr moose]

50 minutes ago, Derrk said:

it must've taken some time to scan the entire internet

Nah, the internet is really small, according to moss and roy it's about the size of a shoe box with red light on it. 

[Arika]

3 minutes ago, colonel_mortis said:

Of all the things to random, a git repository must be one of the stupidest things you could choose. The entire point of a git repository on something like GitHub is that you have a local copy that you synchronise with GitHub, so one git push -f later and you're back up and running.

There will obviously be some repos that weren't synchronised, or branches that people want to recover, but on the whole this seems like a lot of effort for not much gain.

i was going to say, if you dont also have a local copy you're doing it very wrong

[WereCatf]

2 hours ago, PacketMan said:

Please remove my past projects so I don't feel ashamed of my old code.

I'm ashamed of even my current code!

[Zodiark1593]

And this is where the hacker comes across some code that contains ransonware itself and encrypts hacker's computer.

[Chunchunmaru_]

Putting a ramsonware on a GIT repository...

Genius idea, because people do not have a local copy...

[aezakmi]

Git gud and don't upload passwords to repos.

[Drak3]

16 minutes ago, Chunchunmaru_ said:

Putting a ramsonware on a GIT repository...

Genius idea, because people do not have a local copy...

 

6 hours ago, colonel_mortis said:

Of all the things to random, a git repository must be one of the stupidest things you could choose. The entire point of a git repository on something like GitHub is that you have a local copy that you synchronise with GitHub, so one git push -f later and you're back up and running.

There will obviously be some repos that weren't synchronised, or branches that people want to recover, but on the whole this seems like a lot of effort for not much gain.

6 hours ago, Arika S said:

i was going to say, if you dont also have a local copy you're doing it very wrong

It still affects end users that rely on repositories for updates and rollbacks.

[colonel_mortis]

24 minutes ago, Drak3 said:

 

It still affects end users that rely on repositories for updates and rollbacks.

It affects people, but the end users aren't going to pay the ransom—only the repository owner would do that, and they are also the people who can probably recover the repository without paying the ransom (and if they don't have a local copy, they probably aren't actively developing it at the moment, so they're less likely to be interested in paying for it anyway).

[BuckGup]

8 hours ago, Derrk said:

it must've taken some time to scan the entire internet

Actually no with things like Shodan.io and Cenysys they said to scan the entire internet it takes about 24 minutes

[Derrk]

8 hours ago, mr moose said:

Nah, the internet is really small, according to moss and roy it's about the size of a shoe box with red light on it. 

I thought it was a series of tubes

[FezBoy]

43 minutes ago, Derrk said:

I thought it was a series of tubes

The shoe box is filled with tiny tubes, like the windows xp screen saver

[wasab]

Hackers hacking the developers. What can go wrong? 

[wasab]

4 hours ago, PacketMan said:

There is always room for improvement! A pity that we are all lazy ass coders hahaha

No shame being lazy. I write shitty code too.