GitHub confirmed Monday that attackers stole three digital certificates used for desktop and Atom applications in a December 2022 cyberattack.
write in blog postthe company also said after investigating the incident, it concluded that there was no risk to the GitHub.com service and no unauthorized changes to the project.
“A set of encrypted code-signing certificates has been leaked. However, the certificates are password-protected and there is no evidence of malicious use,” said Alexis Wales, vice president of security operations at GitHub. Read the post of
“As a precautionary measure, we will revoke the public certificates used for the GitHub Desktop and Atom applications. Revoking these certificates will disable GitHub Desktop for Mac and some versions of Atom. “
Specifically, some versions of GitHub Desktop for Mac from 3.0.2 to 3.1.2 will stop working on February 2nd, but GitHub Desktop for Windows will not be affected. As for the Atom text editor, versions 1.63.0 and 1.63.1 will no longer work.
To continue using the software solution, Github We encouraged Mac users to upgrade their GitHub Desktop version to the latest release. In contrast, Atom users must download previous program versions to continue working.
“The security and reliability of GitHub and the broader developer ecosystem are our top priorities,” Wales added. “To continue using GitHub Desktop and Atom, we encourage users to act on the recommendations above.”
According to Kevin Bocek, Vice President of Security Strategy and Threat Intelligence at come, revoking the certificate is a smart move. A threat actor could use the certificate to disguise the software as coming from her GitHub.
“In the wrong hands, these machine identities could be used to pretend to be trustworthy. […]This is a powerful weapon that enables supply chain attacks against other software developers and subsequent (or past) unknown attacks,” said Bocek. Information security on mail.
“To protect against such events, which are becoming increasingly common, security engineering teams must deploy a control plane to automate machine identity management.”
GitHub’s disclosure comes a few weeks after the company introduced new features to set up automatic code scanning About repositories.
