GitHub flaw could put millions of users at risk

This vulnerability poses a significant threat to repositories owned by reputable organizations such as Google.

Millions of pieces of software at risk on GitHub, no less. This is the cry of alarm launched by Aqua, a company specializing in cloud security. At issue: a critical flaw called RepoJacking, which affects millions of repositories hosted on the collaborative development platform.

This flaw allows hackers to infiltrate repositories, including those belonging to well-known organizations like Google or Lyft. Once infiltrated, they can manipulate the source code, which can have disastrous consequences for users.

When hackers take over the GitHub repository

Think of your GitHub repositories as digital vaults where developers safely store code and project files. An ingenious system, called Git, watches over these vaults, tracking each modification and allowing several developers to collaborate. But be careful, because if a hacker manages to break into one of them, the consequences can be disastrous.

The code then becomes a weapon. Introduction of malware, theft of sensitive data, sabotage of the project, anything is possible. The ramifications extend far and wide, causing security breaches, data leaks and significant delays.

Vigilance is therefore required. Regularly backing up your repositories and carefully managing access becomes crucial to protect your valuable code and guarantee the security of your projects.

The RepoJacking threat

Dependency repository hijacking, also known as RepoJacking, represents a growing threat to software security. This attack relies on exploiting abandoned or spoofed GitHub accounts to distribute compromised versions of popular software. Infected software can then perform malicious actions on users’ systems.

The mechanism is then in motion. Attackers identify and harvest GitHub accounts that are inactive or whose usernames have been changed.
They then inject malicious code into these software repositories controlled by the compromised accounts.
Infected software is then distributed via the dependency mechanisms of software development platforms.

These attacks are not new. In 2016, a student uploaded custom scripts to popular package repositories such as RubyGems, PyPi, and NPM. In this manipulation, it impersonated legitimate packages, thereby exploiting user errors when selecting package names, a technique known as typosquatting.

In 2021, a researcher employed the technique of dependency confusion attack, also called namespace confusion attack, to compromise the networks of large companies such as Apple, Microsoft, and Tesla.

Source : CySecurity News, Aquasec