Slashdot Mirror
GitHub Hacked
MrSeb writes "Over the weekend, developer Egor Homakov exploited a gaping vulnerability in GitHub that allowed him (or anyone else with basic hacker know-how) to gain administrator access to projects such as Ruby on Rails, Linux, and millions of others. GitHub uses the Ruby on Rails application framework, and Rails has been weak to what's known as a mass-assignment vulnerability for years. Basically, Homakov exploited this vulnerability to add his public key to the Rails project on GitHub, which then meant that GitHub identified him as an administrator of the project. From here, he could effectively do anything, including deleting the entire project from the web; instead, he posted a fairly comical commit. GitHub summarily suspended Homakov, fixed the hole, and, after 'reviewing his activity,' he has been reinstated. Homakov could've gained administrative access to the master branch of any project on GitHub and deleted the history, committed junk, or closed or opened tracker tickets."
That's what you get when you allow Italians like this guy on America's internet. Don't say I didn't warn you.
The remedy is that we all need to be more proactive about patronizing Wisconsin cheese and California wine.
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
Oh wait.. this is an open source community that understood what his intentions where and didn't have a knee jerk reaction. What I guess intelligence trumps mass panic and ignorance.
So, somebody hacked into a computer system to gain access to open source software. Brilliant.
Well this is an ironic situation. Good thing he had good intentions lol. I find it funny that since this guy hacked github and they fixed it. But seriously, shouldn't people hire hackers like him to make projects move faster ? l Sincerely believe that if they "work" together, projects would move faster for sure lol.
Its been around for years
http://www.gnu.org/software/gift/
...to never use Ruby on Rails or trust any developer who uses it. Such a horrid framework backed by the most elitist pricks I've ever seen. I'm glad they got hacked. The more negative press they get to better. Kick those faux devs out on to the street.
To those Mac fanboys out there who think they are "developers". Grow up, use a real OS, and use a real goddamn language and framework.
Also, GitHub sucks. This should be obvious by their choice of framework to run their site.
This lowers the trust of the Linux source a notch. Who can really go over every line of code in the source to make sure someone hasn't already snuck in something malicious years ago?
Although the advantage of open source is that more eyes can go over it.
I think it's time to think about repository for strategic software, like Linux, GCC and so on.
Such a hacking can compromise a large part of the internet. Because someone can introduce backdoors, the nasty ones I mean, so deep to evade any check.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Please respect this, once and for all, when posting stuff like this: "Hacking" is NOT "Cracking"! http://www.geek.com/forums/topic/hacking-and-cracking
There are 2 types of people in the world - those who understand decimal and those who don't.
I mean, stupid motherfuckers !! It's idiots like them that that gets idiots like YOU get OWNED !!
Fortunately, git is a distributed version control system, meaning that, usually, there is a copy of the sources and history information elsewhere.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
...as if millions of voices suddenly cried out from coffee shops in terror and were suddenly pwned. I fear something terrible, and totally predictable, has happened.
Just wait a few years, Ruby on fails will strike back!
In a related story, the sun rose in the east today.
Apparently not, and despite all the years of bullshit on /. that Linux = Secure, is just that - complete bullshit, & this is just another example thereof.
http://uptime.netcraft.com/up/graph?site=github.com
Complete bullshit, to further the agendas of the desperate (who have only 1.19% of marketshare on PC Server & Desktops vs. Windows' 95% of better)...
ANDROID on smartphones does the rest (and it IS a Linux) and there's NO QUESTION it's being "shredded" on the security front too (and yet /.'er propoganda for DECADES NOW says Linux = Secure? LMAO, bullshit!).
he could have added a one character integer overflow to net/ipv4/tcp_input.c
What's GitHub?
This guy is very good example of what the real hacker is, and what they should be. Kudos man.
That's the "best you've got" vs. truths here -> http://it.slashdot.org/comments.pl?sid=2707867&cid=39247333
That could've gone a lot worse...and to think many stupid countries are trying to make such benevolent activities illegal.
"When information is power, privacy is freedom" - Jah-Wren Ryel
These days the only way to get some guys to fix their code is to pwn it.
https://github.com/rails/rails/issues/5228
is a very sad thing to read. basically, he reported this really awful default behavior days ago, and got brushed off by rails maintainers.
Apparently GitHub's own admin isn't "pro" enough...
Matt Damon
"To use the find_mass_assignment plugin, simply install it from GitHub as follows:"
lol.
Aliens.
Fortunately, GIT itself, which is a replicated central code revision system, isn't vulnerable to single point repository attack. Thus, he could've injected something, but *any* of the developers would've noticed when they tried to sync local and remote repos. (In fact, this is probably how his commit was discovered.)
So, for all you worry-worts complaining about possible code injections into src, there shouldn't be anything to worry about.
Not with git.
Git is designed from start make any such messing with the source code instantly evident. That's because every developer has a full copy of the source code _and_ history, cryptographically signed. So if anybody changed a comma in any file it will be _immediately_ evident. Much more than a red cloud around you in a public pool. It also makes losing the history of the code virtually impossible (I mean git, not the red stuff around you).
Github.com runs Linux, and everyone here says Linux = Secure. How come they were broken into then? Don't they KNOW how to write secure code and secure the OS?? Apparently not.
(The funniest part is you're making EXCUSES, nothing more)
Especially after all those years-to-decade here of "Linux is Secure" b.s., that this breakin (amongst others such as this too with the Linux sourcecode repository @ KERNEL.ORG being broken into also in the not too distant past -> http://www.theregister.co.uk/2011/08/31/linux_kernel_security_breach/ ) exemplifies as pure bullshit.
"Geesh, you ACs and your ignorant comments.." - by Gaygirlie (1657131) on Monday March 05, @09:52AM (#39247463) Homepage
Geesh, you Penguins and your ignorance of how to secure an Operating System and/or server OR how to write secure code... ANDROID only proves MORE OF THE SAME, period.
Ruby on Rails - the perfect blend of poor performance (Ruby) and gaping holes (Rails).
Let's call it what it is, Anti-Social Media.
OK, the blog is slashdot'd at the moment, but lets see if I have this right. Basically, you take an active record and just copy values from the POST data into it and then save it ... and this is the default behaviour? Do I have that right because, is so .... .... dear god, what were the ruby-on-rails people smoking when they thought that was a clever idea, its puts ROR on a level with PHP and its magic global variables. Note only that, but what were the github people smoking, the same? Using an insane facility is doubly insane.
Methinks a lot of people need to go and read some web design stuff and realise that active records (or models - django users take not) are not synonymous with the "Model" (business logic) in MVC.
But Ruby is just so much more...PRODUCTIVE! Once again we learn the error of trusting Ruby scripters with the security of our systems.
"Over the weekend, developer Egor Homakov exploited a gaping vulnerability in GitHub that allowed him (or anyone else with basic hacker know-how) to gain administrator access to projects such as Ruby on Rails, Linux, and millions of others.
Linux??? Can we mod summary as troll? Linux has its origin repository in kernel.org and is distributed over cloned repositories all over the world including my laptop. One can't simply inject a commit into one of those repositories (such as github) and expect it to automatically propagate into kernel.org.
Furthermore, even if you manage to inject a commit into some random project at Github, high are the chances that it would be detected by another developer. Who commits to a repository without reading the commit history?
Now, this Rails vulnerability is rather serious and deserves attention but this article is just plain FUD against github. Congratulations!
At least the message was understood loud and clear... It took a couple of hours and a commit to Rails was made to change the default: https://github.com/rails/rails/commit/641a4f62405cc2765424320932902ed8076b5d38
http://it.slashdot.org/comments.pl?sid=2707867&cid=39247333
Here -> http://it.slashdot.org/comments.pl?sid=2707867&cid=39247333 OR here -> http://it.slashdot.org/comments.pl?sid=2707867&cid=39247755
This is what happens when you use a piece of shit language like PHP to build real applications... PHP just isn't up to the job. Why on Earth they would even consider using PHP is beyond me.
http://youtu.be/5NNOrp_83RU
I see you trollin'.
Funny your crap doesn't disprove what's noted here-> http://it.slashdot.org/comments.pl?sid=2707867&cid=39247333 and here-> http://it.slashdot.org/comments.pl?sid=2707867&cid=39247755 now, does it?
Nope.
Why don't you spend time teaching the dolts @ KERNEL.ORG and GITHUB.COM just exactly HOW to write secure code then instead of trolling douchebag?
They obviously need such instruction, or does the fact they were busted into!
(Now,who KNOWS what kind of "Open SORES source" you'll be getting now & what sort of bushwhacks are built into it after those break-ins)...
However/Then again: That's assuming YOU actually know how to do that, but trolls like yourself, 9/10 times? Useless "armchair QB's" @ best/most.
Your stupidity only proves my points even more, AND, more importantly? ANDROID, & these breakins only do moreso as to MY points I posted...
* Thank you!
People are playing apologists for RoR, all singing together: "nothing to see here, thanks to Git Linux (and all the other projects hosted here) shall not get pwned".
Now I agree with the Git part, and that is a very good thing that any wannabe hacker trying to inject a backdoor by modifying Linux shall be caught near-instantly thanks to Git's (very secure) nature.
But shouldn't all these apologists step back a bit and admit that there's a very serious issue here: RoR's security model full of holes?
Like... RoR. Exploit. Anyone?
Everytime a PHP story is posted, the rail fans rant about PHP's insecurity... yet here a massive flaw in rails basic design has rendered every single rails project out there vulnerable... wonder if the rail fans will acknowledge this massive failure AND the rail team slow response to this in the future. Doubt it.
But don't worry. I will remind them ;)
The lesson here? Never claim your project is more secure because someone somewhere is browsing your root directory right now.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Why do people who gain such knowledge insist on pulling this kind of crap. Why not just attempt to disclose the bug to the site owners and let them fix it. If they refuse, post the info publicly to force their hand. Defacing a project on the site is like a 3 year finding a crayon and looking up and seeing that there's a wall to draw on.
...quicker, easier, more seductive the darkside is...but more powerful, it is not.
I'm told you can find lots of low performance and gaping holes in Las Vegas, too.
I know it's not that commonly used by webapps but 15 years or so there have been extensive explanation as to how you could cryptographically sign every single POST request so that: a) fixed input parameters could not be modified b) no additional parameters could be added to the POST and c) restriction could be put on what 'user supplied' input parameters could contain.
Are the RoR developers *that* clueless?
Their off topic illogical trolling only proves your points even more APK (with their weak mod downs too), rest assured on that account.
When did Microsoft and Oracle start doing Open Source maintenance? Or did the GitHub team download their development principles and follow those instead of doing security reviews?
Both Microsoft and Oracle are notorious for leaving reported bugs open for years unless someone demonstrates an effective exploit using the bug. But historically, Open Source projects have taken such risks seriously and closed the holes long before an exploit showed up.
To me, that "constant maintenance" aspect of open source is it's biggest selling point compared to closed-source products. Not only can people review code and find weaknesses, they can either fix them or submit them as bugs for a project, secure in the knowledge that it will be dealt with.
Apparently that's not the case with all OSS projects. And that's a shame -- because aside from vendor lock-in, this has always been one of the most important "features" that the OSS cognoscenti have preached.
I consider the application of timely repairs and updates so important to security that I built a system whose primary purpose is not to develop initial core application code, but to apply such fixes to all projects under maintenance!
I do not fail; I succeed at finding out what does not work.
This isn't actually a hole in rails.. If you use mass assignment, you need to protect attributes you don't want assigned with attr_protected on your model.
:password => 'hacked'})
:password
If you don't want people to do this:
@user.update_attributes({:favorite_color => 'blue',
You need to do this:
class User < ActiveRecord::Base
attr_protected
end
Here (proving his points for him, since you resort to that) -> http://it.slashdot.org/comments.pl?sid=2707867&cid=39250601
/ducks
from https://github.com/rails/rails/issues/5239
I'm Bender from Future
ALL UR ISSUES ARE BELONG TO US
geez. github y u SO open?
...made my day.
To calm any fears that no rogue commits have been added as a result of this hack?
Is git log enough and looking at the last datetime stamp?
must have emerge world and it updated rails config files /ducks
Couldn't resist
"Mind, as manifested by the capacity to make choices, is to some extent present in every electron." -Freeman Dyson
While it's true that it was sloppy coding, it is also true that the default is not really safe - and it probably should be.
They're still trying to hide your posts apk via moddowns with no computer-based technical information to justify the downmod. They're pitiful. All they have is their off-topic illogical "comebacks" vs. facts you posted. This is how you know you beat the hell out of them once again as usual.
They're still trying to hide your posts apk via moddowns with no computer-based technical information to justify the downmod. They're pitiful chumps. All the Penguins have is their off-topic illogical "comebacks" vs. facts you posted. This is how you know you beat the hell out of them once again as usual.
Like continuing trying to hide your posts apk via moddowns with no computer-based technical information to justify the downmod. They're pitiful and this evidences it. All they have is their off-topic illogical "comebacks" vs. facts you posted. This is how you know you beat the hell out of them once again as usual.
In defense of Rails, this isn't a bug, vulnerability, exploit or weakness of RoR its self. The "update_attributes" functionality on a model (which writes new values to a database row) has to be used very carefully. Anybody worth their salt with RoR should know that. If you blindly pass a unsanitized/unfiltered hash directly from the submission from a user to update_attributes, you are definitely asking for trouble and/or are lazy/ignorant at best, imho.
That pretty much summarizes it :P quite funny also, thank you!
Internet hacks YOU!
This isn't actually a hole in rails.. If you use mass assignment,[...]
No. The problem is that any idiot who thinks he doesn't need to sanitise user input is going to get fucked.
And did.
Watch this Heartland Institute video
I've been spending too much time on Reddit, where 70% of communication is done with memes. (The rest are puns)
"Mind, as manifested by the capacity to make choices, is to some extent present in every electron." -Freeman Dyson
So if he just told the model that this is a protected attribute, he would have been fine... Its not hard to do this and its a bug like any other bug, not some systematic problem with Rails itself.
So, you'd rather go with a system that uses fail-deadly than fail-safe.
Ok.
Watch this Heartland Institute video
Based on TFA I thought the hack was more about a default flaw with Ruby on Rails key signing, not anything that was specific to github.
Because of its distributed and decentralized nature, it would be very difficult to sneak any changes into a project or its history undetected. Every other copy of the project repo will begin screaming "foul play" when their developers try to sync.
The real question is whether other more nefarious individuals preceded him undetected.