InfoSecBulletin Cybersecurity for mankind
Recorded Future, a threat intelligence firm, has cautioned that malicious actors are using GitHub services more to carry out secret cyber-attacks and has advised IT teams to act.
Its new report, Flying Under the Radar: Abusing GitHub for Malicious Infrastructure, revealed the most popular GitHub services for threat actors.
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
Between March and November 2023, GitHub Raw, GitHub Objects, and GitHub Pages were the most commonly used in attacks, according to an analysis of threat intelligence samples.
GitHub has nearly 100 million developers. This means it could be a big problem if it is misused.
Recorded Future stated that threat actors use it to hide malicious activity by blending in with benign network traffic. GitHub services are often unblocked in organizations and have high uptime. Additionally, they require minimal new account verification and offer limited detection possibilities for service providers.
The report said that it is a popular, inexpensive, and very effective platform for controlling malware and transferring data secretly.
Organizations need to consider GitHub in their threat modelling, Recorded Future argued.
“In the near term, defenders should pursue a service-based strategy by flagging or even blocking specific GitHub services that are not normally used in their environment and are known to be used maliciously,” the report noted.
“This should be paired with a context-based strategy based on the principle that only specific parts of a corporate environment necessitate interaction with particular GitHub services. In the longer term, organizations should allocate resources to better understand how GitHub and other code repositories are abused.”
It concluded with eight recommendations:
*Enhance visibility into GitHub with granular monitoring of all web and cloud traffic and context-aware policies enforced at the instance level
* Maintain an up-to-date asset inventory listing all users authorized to access GitHub
* Adapt detection strategies to align with the organization’s particular environment
* Deploy adaptive security policies, potentially alongside application allow-listing
* Protect GitHub accounts to prevent hijacking by threat actors to steal code or use as C&C infrastructure
* Continually assess effectiveness of threat detection capabilities by integrating scenarios of GitHub abuse into attack simulations
* Collaborate with GitHub to help it fight back against known malicious activity on the platform
* Perform proactive threat hunting to fight unknown instances of GitHub abuse
