Stephan van Rooij’s Post

🧐 Anyone can Access Deleted and Private Repository Data on GitHub ◆ Truffle Security Co. ｢ Cross Fork Object Reference (CFOR). A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). Similar to an Insecure Direct Object Reference, in CFOR users supply commit hashes to directly access commit data that otherwise would not be visible to them ｣ https://lnkd.in/d2GwB3-J #github #security #vulnerability

This is becoming too common an occurrence. Just days ago the Gitloker extortion attacks and now The New York Times. Recommendations are as expected: ⚫ Review and revoke unauthorized access to SSH keys, deploy keys, and authorized integrations. ⚫ Verify owners and users are authorized to do what has been scoped. ⚫ Review account security logs to track repository changes. ⚫ Manage webhooks on your repositories. ⚫ Check for and revoke any new deploy keys It's not that these are hard items to put into place. It's that correlation of all these items at scale is massively difficult with manual methods and disparate datasets. If you want to see how Astrix Security can help or just want to talk all things NHI, send me a message. I'm happy to help and engage. Awareness and education breeds action and change.

If you use GitHub, you have a (private or public) repository that has been forked at some point, and you have had to remove sensitive data from said repository in the past; this article is very relevant to you. https://lnkd.in/eddH8mzz #github #security #repo

Wow, a new #security threat unlocked! Commits to private #GitHub repos are public if you make a fork of that repo and change the visibility to public. Let's say, you decided to open source part of your application and keep the rest as internal. They call it the fork network. If one is public, the whole network is public. By design.

Researchers have made a concerning discovery regarding deleted GitHub data. It has been found that information thought to be erased may still be accessible, leaving access keys at risk even after deletion. This revelation highlights a potential vulnerability that users should be aware of. Stay informed and take precautions to protect your data. Read more: https://buff.ly/4fh2kgV #deletegithub #vulnerability

Interesting, note-worthy article related to the Discord Top.gg malware incident I forwarded earlier. Notice the trend of collaboration, open collaboration we are seeing in many of these articles?

Forked GitHub repos are NOT strict copies. This is a security nightmare for leaked info & practically insecure by design. Struggle to see the trade-off here behind this design decision, definitely not security. https://lnkd.in/eWX4nDaH

🚨 Recent findings reveal that a staggering 12.8 million auth secrets and keys were accidentally exposed on GitHub in 2023 alone and compromised credentials accounted for 50% of the root cause for all attacks recorded in the first half of the year. We can protect our projects be part of this statistic! 🔐 I ended up writing a blog on how we can use opensource tools like **Gitleaks & Pre-commit** to prevent accidental secret commits in your repositories! Hope it helps. 🛡️ #DevSecOps #OpenSource https://lnkd.in/gS9g3rfy

📢 New Research! Announcing the publication of our new research report, The State of GitHub Actions Security. ❓What did the research entail? This report is based on the Legit research team's analysis (led by Noam Dotan) of 2,500,000 GitHub Actions workflow files belonging to 553,000 organizations and personal users. ❓What were the results? Bottom line: Most GitHub Actions workflows are insecure in some way; they are overly privileged, have risky dependencies, etc. Past Legit research reveals that even projects from enterprises like Google and Apache are flawed. The security of custom GitHub Actions (those developed by the community to enhance GitHub Actions capabilities) is especially concerning. Most of the Actions there are: • Not verified • Maintained by one developer • Have low security scores based on OpenSSF Scorecard ❓How can you learn more? Read our new blog post to get an overview of the data, our analysis, and our recommendations for mitigating risk: https://hubs.li/Q02GK87R0 Or Download the full report: https://hubs.li/Q02GJRNL0 #GitHub #ASPM #ApplicationSecurity #LegitSecurity

Shout out to Noam Dotan for putting together this amazing report on the state of GitHub Actions Security! Noam and team investigated and scanned 2.5 million workflows from more than 500,000 organizations, and uncovered numerous critical insights on some of risks found within these environments. The number one takeaway here is that MOST Github Actions workflows had some form of insecurity that introduced risk, whether that they were over privileged, had risky dependencies, or some other misconfiguration. 💥 Read our newest blog post to get an overview of the data, our analysis, and our recommendations for mitigating risk: https://hubs.li/Q02GK87R0 #supplychainsecuritymatterstoo #githubactions #applicationsecurity #toolegit