Network sources report that hundreds of developers have discovered code missing from their Git repositories. An unknown hacker threatens to publish the code if their ransom demands are not met within the specified timeframe. Reports of the attacks emerged on Saturday. Apparently, they were coordinated through hosting-Git services (GitHub, Bitbucket, GitLab). It is still unclear how the attacks were carried out.
It is reported that the hacker is deleting all source code from the repository and leaving a message asking for a ransom of 0.1 bitcoin, which is approximately $570. The hacker also states that all the code is saved and located on one of their controlled servers. If the ransom is not received within 10 days, they promise to release the stolen code to the public.
According to BitcoinAbuse.com, which tracks bitcoin addresses linked to suspicious activities, 27 reports have been recorded for the specified address over the past day, all containing the same text.
Some users who fell victim to the unknown hacker reported that they had used insufficiently secure passwords for their accounts and did not delete access tokens for applications that had not been used for a long time. Apparently, the hacker scanned the network searching for Git configuration files, discovery of which allowed them to extract user credentials.
GitLab's security director, Kathy Wang, confirmed the issue, stating that an investigation into the incident was initiated yesterday when the first user complaint was received. She also reported that the accounts that were hacked have been identified and their owners have already been notified. The work done helped confirm suspicions that the victims used insufficiently secure passwords. Users are recommended to use specialized password management tools, as well as two-factor authentication, to prevent such issues in the future.
Participants of the StackExchange forum examined the situation and concluded that the hacker does not delete all the code but alters the Git commit headers. This means that in some cases, users will be able to recover lost code. Users facing this issue are advised to contact service support.
