The attacker hacked dozens of organizations using stolen OAuth tokens
GitHub revealed today that an attacker is using stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories.
Since this campaign was first spotted on April 12, 2022, the threat actor has already accessed and stolen data from dozens of victimized organizations using Heroku and Travis-CI managed OAuth apps, including npm .
“The applications managed by these integrators have been used by GitHub users, including GitHub itself,” GitHub Chief Security Officer (CSO) Mike Hanley revealed today.
“We do not believe that the attacker obtained these tokens through a compromise of GitHub or its systems, because the tokens in question are not stored by GitHub in their original and usable formats.
“Our analysis of other behaviors by the threat actor suggests that the actors could undermine the contents of the downloaded private repository, which the stolen OAuth token had access to, for secrets that could be used to rotate in other infrastructures.”
According to Hanley, the list of affected OAuth applications includes:
- Heroku Dashboard (ID: 145909)
- Heroku Dashboard (ID: 628778)
- Heroku Dashboard – Preview (ID: 313468)
- Heroku Dashboard – Classic (ID: 363831)
- Travis CI (ID: 9216)
GitHub Security identified unauthorized access to GitHub’s npm production infrastructure on April 12 after the attacker used a compromised AWS API key.
The attacker likely obtained the API key after downloading multiple private npm repositories using stolen OAuth tokens.
“After discovering the largest theft of third-party OAuth tokens not stored by GitHub or npm on the evening of April 13, we immediately took action to secure GitHub and npm by revoking the GitHub associated tokens and internal npm use of these applications. compromises, “Hanley added.
The npm organization impact includes unauthorized access to private GitHub.com repositories and “potential access” to npm packages on AWS S3 storage.
GitHub uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Learn more about the impact on GitHub, npm, and our users. https://t.co/eB7IJfJfh1
– GitHub Security (@GitHubSecurity) April 15, 2022
GitHub private repositories are not affected
Although the attacker was able to steal data from the compromised repositories, GitHub believes that none of the packages were modified and that no data or user account credentials were accessed in the incident.
“npm uses a completely separate infrastructure from GitHub.com; GitHub was not affected by this original attack,” Hanley said.
“While the investigation continues, we have found no evidence that other private repositories owned by GitHub were cloned by the attacker using stolen third-party OAuth tokens.”
GitHub is working to notify all affected users and organizations as they are identified with additional information.
You should review your organization’s audit logs and user account security logs for any abnormal malicious activity.
You can find out more about how GitHub has responded to protect its users and what customers and organizations need to know in the security advisory released on Friday.