{"id":217624,"date":"2019-05-04T07:23:22","date_gmt":"2019-05-04T05:23:22","guid":{"rendered":"https:\/\/www.borncity.com\/blog\/?p=217624"},"modified":"2022-12-24T01:34:46","modified_gmt":"2022-12-24T00:34:46","slug":"erpressung-hacker-lschen-git-quellcode-repositories","status":"publish","type":"post","link":"https:\/\/borncity.com\/blog\/2019\/05\/04\/erpressung-hacker-lschen-git-quellcode-repositories\/","title":{"rendered":"Erpressung: Hacker l&ouml;schen Git-Quellcode-Repositories"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"https:\/\/borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Schutz.jpg\" width=\"40\" align=\"left\" height=\"47\"\/>Hunderte Entwickler mussten gerade feststellen, dass Hacker ihre Quellcode-Gits (GitHub, Bitbucket, GitLab) gel\u00f6scht und mit Zufallsdaten gef\u00fcllt haben. Die Hacker fordern L\u00f6segeld binnen 10 Tagen,&nbsp; sonst w\u00fcrden die Daten gel\u00f6scht.<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/vg04.met.vgwort.de\/na\/f89884772d61433482cf0419dee65bee\" width=\"1\" height=\"1\"\/>Der Angriff scheint heute Nacht koordiniert auf verschiedene 'Git-Konten' angelaufen zu sein. Die Opfer fanden dann nur noch eine Notiz auf ihrem Git vor, die L\u00f6segeld in Form von Bitcoins fordert. <\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"de\">\n<p lang=\"en\" dir=\"ltr\">Here's the ransom note. No funds received (except a test) in the linked BTC address. <a href=\"https:\/\/t.co\/UZ0CY6gmoa\">pic.twitter.com\/UZ0CY6gmoa<\/a><\/p>\n<p>\u2014 Catalin Cimpanu (@campuscodi) <a href=\"https:\/\/twitter.com\/campuscodi\/status\/1124403643896217601?ref_src=twsrc%5Etfw\">3. Mai 2019<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<p>Die Erpresser fordern lediglich 0,1 Bitcoins (570 $) binnen 10 Tagen. Andernfalls w\u00fcrde der 'gesicherte Code' gel\u00f6scht. Opfer k\u00f6nnen Proben des 'gesicherten Quellcodes' anfordern. Auf der <a href=\"https:\/\/web.archive.org\/web\/20220924051511\/https:\/\/www.bitcoinabuse.com\/reports\/1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA\" target=\"_blank\" rel=\"noopener noreferrer\">Bitcoin Abuse-Datenbank<\/a> finden sich inzwischen 28 F\u00e4lle, wo Opfer einen Eintrag hinterlassen haben. <\/p>\n<p>Auf Stack-Exchange findet sich <a href=\"https:\/\/security.stackexchange.com\/questions\/209448\/gitlab-account-hacked-and-repo-wiped\" target=\"_blank\" rel=\"noopener noreferrer\">dieser Thread<\/a>, der die Geschichte berichtet. Es handelt sich um einen Entwickler, der ein privates Projekt auf einem Git hostet. <\/p>\n<blockquote>\n<p><strong>GitLab account hacked and repo wiped<\/strong><\/p>\n<p>I was working on a project, <em>a private repo<\/em>, and suddenly all the commits disappeared and were replaced with a single text file saying  <\/p>\n<blockquote>\n<p>To recover your lost code and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address 1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA and contact us by Email at admin@gitsbackup.com with your Git login and a Proof of Payment. If you are unsure if we have your data, contact us and we will send you a proof. Your code is downloaded and backed up on our servers. If we dont receive your payment in the next 10 Days, we will make your code public or use them otherwise.<\/p>\n<\/blockquote>\n<p>At the time of this happening, Google search didn't show up anything, but in an hour or so <a href=\"https:\/\/web.archive.org\/web\/20220924051511\/https:\/\/www.bitcoinabuse.com\/reports\/1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA\" target=\"_blank\" rel=\"noopener noreferrer\">this<\/a> started coming up.  <\/p>\n<p>I am using SourceTree (always up-to-date) but somehow I doubt that SourceTree is the issue, or that my system (Windows 10) was compromised. I'm not saying it's not that, it's just that I doubt it.  <\/p>\n<p>This happened only to one of my repositories (all of them private) and all the others were left untouched. I changed my password, enabled 2 factor authentication, removed one access token that I wasn't using for years and wrote an email to GitLab in the hopes that they could tell me something about where\/who the attacker got in.  <\/p>\n<p>My password was a weak one that could've been relatively easily cracked via brute-force (it's not a common one but starts with \"a\" and has only a-z characters in it) and it could be that they just automatically checked if they can access the account and then ran some git commands. It is also possible that my email address and that particular password are on a list of leaked accounts. One might argue that if this is how they got in, they would've simply changed the account credentials but searching the Internet revealed that in these cases GitLab\/GitHub will simply restore the credentials for you, and so I assume this is why they didn't do it this way.  <\/p>\n<p>Could've also been that old access token, I can't remember what and where I used it for in the past &#8211; most likely generated for use on a computer I previously owned, so I doubt that that was the issue.  <\/p>\n<p>There are also 4 developers working on it, all having full access to the repository, so their accounts being compromised is also a possibility.  <\/p>\n<p>I've scanned my computer with BitDefender and couldn't find anything but I am not doing shady things on the internet so I don't think that me being infected with a malware\/trojan is what caused this.  <\/p>\n<p>I am waiting for an answer from GitLab and maybe they can shed some light on this. I have the code base on my local Git, so that is not an issue, but I am not pushing the code back to the repository just yet. Also, just in case the code gets published somewhere, I will change any passwords that are to be found in the source (databases, IMAP accounts). <\/p>\n<\/blockquote>\n<p>Der Betroffene hat inzwischen neue Erkenntnisse in Form von Updates gepostet. Der Quellcode ist im Git nicht gel\u00f6scht.  <\/p>\n<blockquote>\n<p><strong>UPDATE<\/strong>  <\/p>\n<p>I found out that the code isn't gone. I tried accessing a commit's hash and it worked. So the code is there but there's something wrong with the HEAD. My knowledge on this is very limited but  <\/p>\n<p><code>git reflog<\/code>  <\/p>\n<p>shows all my commits.  <\/p>\n<p>What this means <em>to me<\/em> is that the attackers most likely didn't clone the repositories (would be a logistical nightmare to do this for all the victims, anyway) and that the chances for them going over the source code looking for sensitive data, or of making the code public are low. It also means <em>to me<\/em> that is not a targeted attack but a random, bulk attack, carried out by a script. I really hope this is the case for our own sake! <\/p>\n<\/blockquote>\n<p>In einem zweiten und dritten Update <a href=\"https:\/\/security.stackexchange.com\/questions\/209448\/gitlab-account-hacked-and-repo-wiped\" target=\"_blank\" rel=\"noopener noreferrer\">dieses Threads<\/a> legt er offen, was er herausgefunden hat und wie er seine Quellen restaurieren kann. Wie er schreibt, ist der Quellcode nicht gel\u00f6scht, die Header der Gits wurden wohl manipuliert. Aktuell deutet vieles darauf hin, dass die Hacker das Internet nach Git-Konfigurationsdateien und extrahierten Anmeldeinformationen gescannt und diese dann f\u00fcr den Zugriff auf Git-Hosting-Diensten verwendet haben.  <\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"de\">\n<p lang=\"en\" dir=\"ltr\">Dang, I thought all those \"\/.git\/config\" scans we detected were harmless. Guess we know what the goal was now.<\/p>\n<p>\u2014 Bad Packets Report (@bad_packets) <a href=\"https:\/\/twitter.com\/bad_packets\/status\/1124429828680085504?ref_src=twsrc%5Etfw\">3. Mai 2019<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>  <\/p>\n<p>Auf ZDnet.com gibt es inzwischen <a href=\"https:\/\/www.zdnet.com\/article\/a-hacker-is-wiping-git-repositories-and-asking-for-a-ransom\/\" target=\"_blank\" rel=\"noopener noreferrer\">diesen Artikel<\/a> zum Thema. Irgend jemand von euch betroffen?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hunderte Entwickler mussten gerade feststellen, dass Hacker ihre Quellcode-Gits (GitHub, Bitbucket, GitLab) gel\u00f6scht und mit Zufallsdaten gef\u00fcllt haben. Die Hacker fordern L\u00f6segeld binnen 10 Tagen,&nbsp; sonst w\u00fcrden die Daten gel\u00f6scht.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[426],"tags":[4328],"class_list":["post-217624","post","type-post","status-publish","format-standard","hentry","category-sicherheit","tag-sicherheit"],"_links":{"self":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/217624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/comments?post=217624"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/217624\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/media?parent=217624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/categories?post=217624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/tags?post=217624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}