X
October 12, 2023
GitHub is the Megladon of source code hosts, and as such, it sports a gargantuan bulls-eye that flashes neon to hackers looking to poison the software supply chain.
As of January 2023, the platform was the world’s biggest, with a reported 100+ million developers and 372+ repositories, including at least 28 million public repositories. That vast landscape of repositories was threatened by a recent impersonation attack, spotted in September, in which malicious pull requests and commits were disguised as Dependabot: a tool that helps to update dependencies on GitHub.
“Users may tend to blindly trust and approve the requests, which end up stealing secrets and passwords,” warned Contrast Security Chief Information Security Officer David Lindner in his CISO Insights column of Sept. 29. “It’s just another reminder to pay close attention to any new requests to commit to your managed codebases.”
But the Dependabot attack was just one of multiple threats that have focused on GitHub. Other recent incidents:
GitHub isn’t the only code repository plastered with a bulls-eye. In July 2021, for example, a credentials-stealing code bomb using legitimate password-recovery tools in Google’s Chrome web browser was found lurking in the npm open-source code repository, waiting to be planted within the sprawling galaxy of apps that pull code from that source.
In fact, a new report from Sonatype found that open-source software supply chain attacks tripled in a year: One in eight open-source downloads were found to have known risk, and 245,000 malicious packages were discovered — twice as much as all previous years combined.
I spoke with Contrast CISO Dave to find out more about the GitHub code security threats that developers and organizations face, as well as the defensive measures they can implement to protect their code and data. Read on for our CISO’s advice.
Analysis of logs showed that some victims of the Dependabot attack found that their accounts had been compromised with stolen PATs (personal access tokens). These tokens are stored locally on developers’ systems and can be used to log in to GitHub without the need to go through two-factor authentication (2FA). While initial analysis didn’t reveal how those credentials were compromised, it could have been the result of a malware infection or installation of a malicious package.
Unintentional exposure of credentials or personal information is, in fact, one of the most common security threats on GitHub. Developers sometimes inadvertently include application programming interface (API) keys, passwords and access tokens in their code repositories. Hackers actively scan GitHub repositories to find such information and exploit it to gain unauthorized access.
“If you're not using fine-grained PATs, those tokens are usually provided with very broad access — more than what you really need,” Dave comments. “And they're easily lost. People, for whatever reason, commit them in code. Or they save them on an email. Or they put them in a document on their laptop. They save them because they need them, but PATs should be stored in password managers, or in some secrets-management tool that their owners may be using at the company they're working for.”
Multiplying the risk of PAT loss is that their owners won’t necessarily detect that they’re gone, he explains. And the risks of PAT loss are intense: “It can result in code theft, or attackers committing code,” the CISO says. “Attackers can use all manner of code functionality: For example, they may be able to access a purchase functionality. Depending on what level of access the PAT has, an attacker may have access to everything. Some people just scope their PATs at the order level: In that case, if the PAT is compromised, it grants full-blown access to every single repo in that organization.”
Switching to GitHub's fine-grained PATs, which limit each user to specific permissions, can reduce risks in case of compromise. Introduced a year ago, these tokens draw from a set of over 50 granular permissions that control access to GitHub’s organization, user and repository APIs. Some of the benefits, as outlined by GitHub in October 2022:
To mitigate the threat, developers should also adopt robust secrets-management practices. Tools like GitHub Actions' Secrets and third-party solutions such as HashiCorp Vault can help store and manage sensitive data securely. At Contrast, we use an enterprise version of TruffleHog: an open-source, secret-scanning tool that searches for credentials in code. The tool can sniff out GitHub tokens — or your precious, God-like AWS tokens, as another example — that someone may have committed to code, Dave notes.
Conduct regular audits of repositories for accidental exposure of secrets.
Malicious actors may attempt to inject code into repositories through pull requests or by exploiting vulnerabilities in third-party dependencies. This code injection can lead to various security issues, including data breaches, code execution and backdoor installations.
Code reviews are essential for identifying and preventing code injection. Automated tools like GitHub's built-in dependency scanning can help identify vulnerable dependencies and highlight potential security risks. Developers should also keep their dependencies up to date to minimize the risk of exploitation.
XSS attacks occur when an attacker injects malicious scripts into web applications viewed by other users. In the context of GitHub, XSS vulnerabilities can be introduced through issues, pull request comments or even the repository's README. These vulnerabilities can compromise user accounts and lead to unauthorized access.
Developers should validate and sanitize user input to prevent XSS attacks. GitHub also provides security features like Content Security Policy (CSP) to mitigate the risk of such attacks. Additionally, regular security audits of issues and comments can help identify and remove malicious content.
Supply-chain attacks involve compromising the software supply chain to inject malicious code into the development process. GitHub's reliance on third-party libraries and dependencies makes it susceptible to such attacks. Attackers may target these dependencies, compromising the integrity of the entire project.
To guard against supply-chain attacks, developers should thoroughly vet and verify their dependencies. Implementing code signing, regularly checking for known vulnerabilities and monitoring the dependency tree for unexpected changes can help ensure the integrity of the supply chain.
While external threats are a significant concern, insider threats cannot be overlooked. Developers or employees with access to GitHub repositories may intentionally or inadvertently leak sensitive information or tamper with code.
Effective access control mechanisms should be in place to restrict access to sensitive repositories. Role-based access control (RBAC), 2FA and regular access audits can help prevent insider threats. Additionally, monitoring tools and anomaly detection systems can alert organizations to suspicious activities.
Malicious actors target highly popular libraries that haven’t been used or updated for some time. They look to take over these “dead” libraries, trying to compromise the maintainer's accounts because of those neglected libraries, Dave says: “They make an update, and if no one's paying attention, it could have malicious code in it.”
SSO solutions such as Okta enable removal of access to repos when employees leave.
In addition to addressing specific threats, there are several best practices that organizations and developers can adopt to enhance GitHub code security:
GitHub application security threats are a grim reality that organizations and developers can’t ignore. By understanding these threats and implementing defensive measures and best practices, you can significantly reduce the risk of security breaches and protect your code, data and reputation. In today's digital age, code security is not a luxury; it’s a necessity. Ensuring that security is maintained throughout the software development life cycle (SDLC) entails securing GitHub and other code repositories: Their role is too pivotal to be overlooked.
Related:
Lisa Vaas is a content machine, having spent years churning out reporting and analysis on information security and other flavors of technology. She’s now keeping the content engines revved to help keep secure code flowing at Contrast Security.
