Open VRM’s Post

🔉 Mishandled GitHub token exposes Mercedes-Benz source code 🔉 The mishandling of GitHub tokens has led to the exposure of Mercedes-Benz source code, with researchers at RedHunt Labs discovering "unrestricted" and "unmonitored " access to an Internal GitHub Enterprise Server. The token providing this access was exposed via a public GitHub repository. 👉 This exposure provided access to a wealth of information, including intellectual property, access keys, connection strings, SSO passwords, API keys, and other critical internal details. It highlights the need for all organizations to secure their code repos and model this attack vector. #cybersecurity #news #github #mercedes #dataleak

So, for anyone out of the loop – GitHub has now implemented push protection as a default feature, which scans code commits for secrets before accepting them. This helps to safeguard against unintentional exposure of private data, such as access tokens and passwords, within public repositories. GitHub boasts its ability to identify over 200 distinct secret patterns and token types. Even after the couple of high-impact breaches due to exposed credentials and secrets that have happened the last few years, GitHub reported that they detected a staggering amount of over 1 million leaked secrets in public repositories in the first 8 weeks of 2024 alone! What additional proactive measures do you think developers and organizations should adopt to prevent secrets from ever being exposed in the first place? Full article: https://lnkd.in/egczUYFX #github #security #devops #cybersecurity

GitHub Vulnerability “ArtiPACKED” Trigger RCE Exploit to Hack Repositories: The research identifies a critical security vulnerability in GitHub Actions artifacts, enabling unauthorized access to tokens and secrets within CI/CD pipelines.  Misconfigured workflows in major organizations’ public repositories exposed sensitive information, potentially compromising cloud environments and allowing attackers to inject malicious code into production systems.  By exploiting leaked GitHub tokens, adversaries could manipulate repositories and […] The post GitHub Vulnerability “ArtiPACKED” Trigger RCE Exploit to Hack Repositories appeared first on Cyber Security News. #CyberSecurity #InfoSec

A critical vulnerability in the GitHub Enterprise Server (GHES), a self-hosted version of GitHub, has been discovered. It lets attackers bypass authentication measures on vulnerable instances and gain unrestricted admin access. More here on the critical security flaw and its patch: https://lnkd.in/ebdFYQK2 #GitHub #IT #Code #Programming #Developers #Cybersecurity #SecurityExploit #SecureCode

Github has a scaling problem. Not the infrastructure itself, but the pace of uploaded malware is more than it can handle. The latest wave of malware started spreading in May of 2023. Threat actors download legitimate code from Github (also leveraging PyPi and NPM repositories) embed the malware and then upload to a new repository with the same name. The entire attack chain is automated so there have been over 100,000 malicious repositories identified. Github is removing the poisoned repos as fast as it can, but the volume and complexity of the attack is challenging their abilities. This is an insight into digital supply chain risks that continue to grow in scale and complexity. When your dev teams download libraries and code from public repos, what steps do they go through to ensure the downloaded code is what was expected -- and safe? As we increase automation in the CI/CD pipelines, authenticity and security checks need to occur earlier. There are rumors that Microsoft is going to push code signing again with the upcoming Windows 12. It is one approach that has been around for quite a while, but hasn't become standard yet. Maybe we need something else? How are you validating the code your teams are downloading, developing and sharing? https://lnkd.in/gi6vxZsZ #cybersecurity #devsecops #cicd #itsabouttrust

I found a great explanation of unsafe reflection at https://lnkd.in/gMxWUW7n

GitHub Vulnerability 'ArtiPACKED' Exposes Repositories to Potential Takeover | Read more hacking news on The Hacker News cybersecurity news website and learn how to protect against cyberattacks and software vulnerabilities.

A vulnerability in an archived Apache project, highlighted the risk of using outdated third-party dependencies. There's more to learn with SimpleCyber, get all the knowledge and solutions to protect your digital security! #SimpleCyber #cybersecurity #Apache

Researchers discovered a vulnerability in an archived #Apache project, highlighting the risk of using outdated third-party dependencies, where attackers can exploit the way package managers prioritize public repositories to install a malicious package with the same name as a legitimate private dependency. #cybersecurity #opensource #archive

Researchers discovered a vulnerability in an archived Apache project, highlighting the risk of using outdated third-party dependencies, where attackers can exploit the way package managers prioritize public repositories to install a malicious package with the same name as a legitimate private dependency. https://lnkd.in/e-jbTGvs #cybersecurity #ciberseguridad