{"id":103789,"date":"2022-04-16T15:37:02","date_gmt":"2022-04-16T13:37:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm"},"modified":"2022-04-16T15:37:02","modified_gmt":"2022-04-16T13:37:02","slug":"ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","title":{"rendered":"An attack on GitHub led to the leak of private repositories and access to NPM infrastructure.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub warned users about an attack aimed at extracting data from private repositories using compromised OAuth tokens generated for Heroku and Travis-CI services. It is reported that during the attack, data leakage occurred from the private repositories of certain organizations that granted access to repositories for the PaaS platform Heroku and the continuous integration system Travis-CI. Among the affected was GitHub itself and the NPM project. <\/p>\n
The attackers managed to extract an API access key for Amazon Web Services from GitHub's private repositories, which was used in the infrastructure of the NPM project. The obtained key allowed access to NPM packages stored in the AWS S3 service. GitHub believes that despite the access to NPM repositories, there was no modification of packages or retrieval of user account-related data. It is also noted that since the infrastructures of GitHub.com and NPM are separate, the attackers did not manage to download the contents of internal GitHub repositories not related to NPM before the compromised tokens were blocked. <\/p>\n
The attack was recorded on April 12 after the attackers attempted to use the AWS API key. Similar attacks on some other organizations that also used Heroku and Travis-CI application tokens were later recorded. The affected organizations are not named, but all users impacted by the attack have been sent appropriate individual notifications. Users of Heroku and Travis-CI applications are advised to review security and audit logs for anomalies and unusual activity. <\/p>\n
It is still unclear how the tokens fell into the hands of the attackers, but GitHub believes they were not obtained as a result of compromising the company's infrastructure, as access authorization tokens from external systems are not stored on GitHub in a usable raw format. An analysis of the attacker's behavior indicated that the primary goal of downloading private repository contents was likely to analyze the presence of sensitive information, such as access keys, that could be used to continue the attack on other elements of the infrastructure. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"