#GITHUB DESKTOP PERSONAL ACCESS TOKEN ARCHIVE#
#GITHUB DESKTOP PERSONAL ACCESS TOKEN SOFTWARE#
#GITHUB DESKTOP PERSONAL ACCESS TOKEN CODE#

The stolen signing certificates were encrypted, and the crooks apparently didn’t get the passwords.

#GITHUB DESKTOP PERSONAL ACCESS TOKEN SOFTWARE#

Note that you wouldn’t already need to be an existing user of either of those specific products to be fooled – the criminals could give GitHub’s imprimatur to almost any software they wanted. This means, in theory, that they could publish rogue software with an official Github seal of approval on it.

#GITHUB DESKTOP PERSONAL ACCESS TOKEN CODE#

The crooks got hold of code signing certificates for the GitHub Desktop and Atom products.This sort of mistake can lead to the very public (and very publicly searchable) leak of private configuration files, private server access keys, personal access tokens and passwords, and even entire directory trees that were simply in the wrong place at the wrong time.įor better or for worse, it’s taken GitHub nearly two months to figure out just how much stuff their attackers got hold of in this case, but the answers are now out, and it looks as though: Open source data leakage can happen when developers inadvertently bundle up private files from their development network into the public code package that they ultimately upload for everyone to access. In fact, this sort of data leakage can even be a problem for public repositories, including open-source source code projects that aren’t secret, and are supposed to be downloadable by anybody. In the case of stolen source code databases, whether they’re stored on GitHub or elsewhere, there’s always the risk that a private repository might include access credentials to other systems, or let cybercriminals get at code signing certificates that are used when actually building the software for public release. Using attack intelligence from one part of a system to wriggle into other parts of the same or other systems is known in the jargon as lateral movement, where cybercriminals first establish what you might call a “beachhead of compromise”, and then try to extend their access from there.

In those emails you may have revealed confidential information about account names, system details, business plans, logon credentials, and more. Note, however, our careful use of the word “directly” in the previous sentence, because the compromise of one account on a system may lead to knock-on effects against other users, or even against the system as a whole.įor example, your corporate email account almost certainly contains correspondence to and from your colleagues, your IT department and other companies.

#GITHUB DESKTOP PERSONAL ACCESS TOKEN ARCHIVE#

Think of this breach like a crook getting hold of your Outlook email archive password and downloading your last month’s worth of messages.īy the time you noticed, your own email would already be gone, but neither Outlook itself nor other users’ accounts would have been directly affected. We’re guessing that GitHub keeps its own code on GitHub (it would be something of a vote of no confidence in itself if it didn’t!), but it wasn’t the underlying GitHub network or storage infrastructure that was breached, just some of GitHub’s own projects that were stored there. Simply put: someone used a pre-generated access code acquired from who-knows-where to leech the contents of various source code repositories that belonged to GitHub itself. Once detected on December 7, 2022, our team immediately revoked the compromised credentials and began investigating potential impact to customers and internal systems. On December 6, 2022, repositories from our atom, desktop, and other deprecated GitHub-owned organizations were cloned by a compromised Personal Access Token (PAT) associated with a machine account. GitHub claims that it spotted the breach quickly, the day after it happened, but by then the damage had been done: This time, the victim (and in some ways, of course, also the culprit) is Microsoft’s GitHub business. Another day, another access-token-based database breach.

Github desktop personal access token