Questions tagged [github]

github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use [git]

github.com is a website for hosting source code using the git version control system. This tag is for questions about security aspects of the github platform. For questions about git itself, please use

83 questions
171
votes
4 answers

GitLab account hacked and repo wiped

I was working on a project, a private repo , and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address…
Stefan Gabos
  • 1,103
  • 2
  • 8
  • 9
107
votes
4 answers

Suspicious GitHub fork

Update (April 15): The forked repo and the user do not exist any more. Yesterday, one of my GitHub projects was forked and there is a suspicious commit on the fork of the repo. As you can see from the commit the GitHub Actions configuration installs…
Giorgi
  • 913
  • 2
  • 6
  • 12
53
votes
2 answers

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab What is going on here?
Jonathan Cross
  • 1,800
  • 1
  • 14
  • 27
21
votes
3 answers

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna , but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx , and the binary included in the repository ( HLuna ) is…
mcruz2401
  • 191
  • 1
  • 7
20
votes
3 answers

How can I ensure that my Git projects have not been tampered with?

The origin of this whole mess is the news article Beware of Lazarus LinkedIn Recruiting Scam Targeting Org’s To Deliver Malware . Someone may have breached my system - as in had access to my personal Linux machine for multiple days. The attackers in…
user2741831
  • 403
  • 4
  • 10
19
votes
1 answer

Github account hacked and repo wiped - Github Response

One of my repo's was wiped today and just a message left in its place with a bitcoin ransom. I've no idea how they accessed my account, can't really see anything on github security page. The domain of the email they want me to contact was only…
Raymie
  • 191
  • 1
  • 6
15
votes
3 answers

Why are the gitlab SSH host key fingerprints not matching?

I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. However, I found that the key does not match the…
HerpDerpington
  • 245
  • 2
  • 9
8
votes
1 answer

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin , I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE…
ShapeOfMatter
  • 583
  • 3
  • 12
8
votes
2 answers

Is it safe to store GPG encrypted data publicly eg on GitHub?

I've been learning some basics of information security and GPG encryption and it's super intriguing. I wanted to understand vulnerabilities behind an idea that I had. After we create our public and private key pair with GPG, it's common and known to…
ggoober
  • 81
  • 1
  • 3
7
votes
1 answer

What was the concern that caused the warning in GitHub Actions documentation about setting NODE_OPTIONS?

In the documentation on GitHub Actions there is a note, Due to security restrictions, GITHUB_ENV cannot be used to set the NODE_OPTIONS environment variable. What exploit were they trying to suppress by making this one-off exception. It would seem…
Evan Carroll
  • 3,297
  • 6
  • 30
  • 48
6
votes
2 answers

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here , the hashsum are made part of the release's filename. Sometimes, at least…
mYnDstrEAm
  • 387
  • 1
  • 4
  • 22
6
votes
1 answer

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. However, I accidentally deleted my public key too (I…
Zak
  • 163
  • 1
  • 4
6
votes
1 answer

How could malicious code changes in a GitHub pull request be masked by an attacker?

When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review. Reviewing the diff is obviously vulnerable to human error, as malicious changes can be snuck in (see…
jamieweb
  • 435
  • 1
  • 3
  • 12
6
votes
2 answers

How can I verify signed commits made by other people?

As identified in this related question , github signs commits made from their application with their GPG key 4AEE18F83AFDEB23 . Online, I can see commits tagged as 'verified'. But when I attempt to verify them on my local, I am unable to: $ git log…
Brendan Roy
  • 163
  • 1
  • 4
5
votes
1 answer

Doesn't saving an SSH passphrase (as suggested by GitHub) negate the security benefits of using a passphrase?

From GitHub Docs : With SSH keys, if someone gains access to your computer, the attacker can gain access to every system that uses that key. To add an extra layer of security, you can add a passphrase to your SSH key. To avoid entering the…
Red Dwarf
  • 153
  • 5
1
2 3 4 5 6