Malware on Github ??

[kernol]

Since the beginning of March 2021, access [at least from where I live] has been periodically blocked to Github ...
https://otx.alienvault.com/indicator/ip/140.82.121.4

Strange ... or fairly common problem for others?

EDIT: I have whitelisted in Skynet ... malware will be within user repositories ... just curious as to whether this is a fairly common issue for Github?

 

[XIII]

My GitHub access has been acting up this week.

Did not consider this, but might be a factor...

 

[kernol]

It seems GitHub may have been grappling with the problem for longer than I was aware of ??
https://nakedsecurity.sophos.com/2020/06/01/github-uncovers-malicious-scanner-targeting-developers/

Not good news if its true .
EDIT: Found this more recent one as well ...
https://www.trendmicro.com/en_us/re...tricks--using-github-to-hide-its-payload.html

 

[podkaracz]

Where are Linux packages coming from? Should linux users be worried or those that belong to os are checked more carefully ? They are probably on separate servers but are not they built from things that are maintained on github?

 

[jeden]

github is a place where people can upload practically everything they want. That does not mean all downloads from there have malware. But you already know that so I don't know what the actual question is.

 

[podkaracz]

github is a place where people can upload practically everything they want. That does not mean all downloads from there have malware. But you already know that so I don't know what the actual question is.

Im hearing a lot about some encrypted files that are invisible but are activated once they are in use. Curious if there is a possibility that there are some hidden encrypted files/code that is sleeping waiting to be awaken in some linux distros for example. Is this possible or this code is tested left and right and it wont get to official repositories for example of some linux distro?

 

[XIII]

Recent real world example of malware on GitHub:

New macOS Malware XcodeSpy Targets Xcode Developers with EggShell Backdoor - SentinelLabs

Targeting software developers is one route to a successful supply chain attack. Now threat actors are going after Apple developers through the Xcode IDE.

labs.sentinelone.com

 

[kernol]

I would have thought first prize would be to compromise routers around the world by injecting malicious code into firmware and/or add-on router apps ... but, not being a coder, I have no idea how difficult or even practical that would be?

Wonder if there's a link between any increased malware activity which there may be on GitHub and the acquisition of GitHub by Microsoft a few years ago?

 

[podkaracz]

I would have thought first prize would be to compromise routers around the world by injecting malicious code into firmware and/or add-on router apps ... but, not being a coder, I have no idea how difficult or even practical that would be?

Wonder if there's a link between any increased malware activity which there may be on GitHub and the acquisition of GitHub by Microsoft a few years ago?

As stated in the article above they are going after developers so people like @RMerlin should take extra caution. Insane how you never know if in theory 100% trusted site is trusted. I know its probably rare because i never encounter anything like that but i think asus servers were compromised before i bought my asus router so it might happen again.

 

[itpp20]

Solarwinds has shown all of us that any supply chain can be compromised, being wary is good, a zero trust approach would be better, which to say the least is a challenge with asus closed source components.

 

[kernol]

As stated in the article above they are going after developers so people like @RMerlin should take extra caution. Insane how you never know if in theory 100% trusted site is trusted. I know its probably rare because i never encounter anything like that but i think asus servers were compromised before i bought my asus router so it might happen again.

I have absolutely no doubt that @RMerlin knows the risks and every confidence that he knows better than most how to avoid the problems.
No worries on that front ... it's the less well informed and less skilled folk with the best intentions ... that are at most risk.

 

[RMerlin]

Without going into details, due to my workflow, it's almost impossible for someone to modify the content of my github repo without me noticing.