GitHub revealed today that an attacker is using stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories.
Since this campaign was first spotted on April 12, 2022, the threat actor has already accessed and stolen data from dozens of victim organizations using OAuth apps maintained by Heroku and Travis-CI, including npm.
“The applications maintained by these integrators were used by GitHub users, including GitHub itself,” revealed Mike Hanley, Chief Security Officer (CSO) at GitHub.
“We do not believe that the attacker obtained these tokens through compromise of GitHub or its systems, as the tokens in question are not stored by GitHub in their original, usable formats.
“Our analysis of different behavior by the threat actor suggests that the actors may be mining the downloaded private repository content, which the stolen OAuth token had access to, for secrets that could be used to run to other infrastructure.”
According to Hanley, the list of affected OAuth applications includes:
Heroku Dashboard (ID: 145909) Heroku Dashboard (ID: 628778) Heroku Dashboard – Preview (ID: 313468) Heroku Dashboard – Classic (ID: 363831) Travis CI (ID: 9216)
GitHub Security identified unauthorized access to GitHub’s npm production infrastructure on April 12 after the attacker used a compromised AWS API key.
The attacker likely obtained the API key after downloading multiple private npm repositories using stolen OAuth tokens.
“When we discovered the wider theft of third-party OAuth tokens that were not stored by GitHub or npm on the evening of April 13, we took immediate action to protect GitHub and npm through tokens associated with GitHub and its internal use.” of npm from these compromised applications.” Hanley added.
The impact on the npm organization includes unauthorized access to private GitHub.com repositories and “potential access” to npm packages on AWS S3 storage.
GitHub found evidence that an attacker misused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Learn more about the impact on GitHub, npm, and our users. https://t.co/eB7IJfJfh1
— GitHub Security (@GitHubSecurity) Apr 15, 2022
GitHub’s private repositories are not affected
Although the attacker was able to steal data from the compromised repositories, GitHub believes that none of the packages were modified and that no user account information or credentials were used in the incident.
“npm uses a completely separate infrastructure from GitHub.com; GitHub was not affected in this original attack,” Hanley said.
“While the investigation continues, we have found no evidence that other private repos owned by GitHub were cloned by the attacker using stolen third-party OAuth tokens.”
GitHub is working to notify all affected users and organizations when identified with additional information.
You should check your organization’s audit logs and your user account security logs for anomalous, potentially malicious activity.
You can learn more about how GitHub has responded to protect its users and what customers and organizations need to know in the security warning published on Friday.
This post Attacker hacked dozens of organizations with stolen OAuth tokens
was original published at “https://www.bleepingcomputer.com/news/security/github-attacker-breached-dozens-of-orgs-using-stolen-oauth-tokens/”
