Millions of software repositories on GitHub are potentially vulnerable to attacks such as: lipo jackingrevealed in a new study.
This includes repositories from Google, Lyft and several other organizations, Massachusetts-based cloud-native security firm Aqua said in a report Wednesday.
Also known as dependency repository hijacking, this supply chain vulnerability allows attacks to take over retired organizations or usernames and expose trojanized versions of repositories to execute malicious code. is a kind of
“When a repository owner changes their username, it creates a link between the old name and the new name for anyone downloading dependencies from the old repository,” said researchers Ilay Goldman and Yakir Kadkoda. says. “But anyone can create an old username and unlink this.”
Alternatively, a similar scenario could occur if repository ownership was transferred to another user and the original account was deleted, allowing a malicious attacker to create an account with the old username. There is a nature.
According to Aqua, an attacker could leverage websites such as GHTorrent to extract GitHub metadata associated with public commits and pull requests to create a list of unique repositories.
An analysis of a subset of 1.25 million repositories in June 2019 found 36,983 repositories vulnerable to RepoJacking, with a success rate of 2.95%.
GitHub contains over 330 million repositories, and the findings suggest that millions of repositories may be vulnerable to similar attacks.
One such repository is google/mathsteps. This was formerly under the ownership of Socratic (socraticorg/mathsteps). Socratic was acquired by Google in 2018.
“When you go to https://github.com/socraticorg/mathsteps, you are redirected to https://github.com/google/mathsteps, so you end up with Google’s repository.” researchers said.
“However, because the socraticorg organization was available, the attacker could open the socraticorg/mathsteps repository, and the user would instead follow Google’s instructions to clone the attacker’s repository. , this would lead to arbitrary code execution on the user.”
This is not the first time such concerns have been raised. In October 2022, GitHub announced that by circumventing the deprecation of the common repository namespace, a security loophole could have been exploited to create malicious repositories and launch supply chain attacks. moved to close the
To mitigate such risks, users are encouraged to regularly inspect the code of links that may be retrieving resources from external GitHub repositories.
“If you change your organization’s name, make sure you still have the previous name, even as a placeholder, to prevent attackers from creating organization names,” the researchers said.
