As you may know, GitHub has detected a breach.
This was originated by an employee installing a malicious VSCode extension (and no doubt escalated via other mechanisms.)
It transpires that the source code of GitHub has been leaked and is available for sale through crime/privacy friendly networks.
The conclusion is that since source code can itself be analyzed by LLMs, there is a high possibility that vulns and privilege escalations may be discovered that would allow further attacks.
Here are some measures you can take:
1- Go through private repos and ensure there are no secrets.
2- Go through private repos, copy them to another system, and delete the repos.
3- Review privacy policies and settings, consider changing your account type to enterprise (I'd recommend going the opposite direction, but this is an option)
4- Consider not using github for a while.
5- If you are using non-essential Github software like GitHub CLI or vscode extensions, uninstall them. Learn to work with Git CLI if necessary.
6- Consider not downloading binaries from Github repos for a while.
7- Consider not downloading source code from GitHub for a while.
Other general recommendations can help as well:
- Actually check hash digests, and ensure that the hash is distributed by other means than the code.
- Consider using or strengthening alternative signature mechanisms like pgp.
- Do not install stuff through package managers that don't review code. Consider writing the code yourself, read an RFC if necessary, it's ok.
- Consider removing packages from the fishiest to the least. It's a chore, there's never time, but now is a good time as any. If a package is fishy, delete it and replace it with some simple code, if the package is not fishy, consider deleting it.
- Consider planting a canary token in places that are likely to get hacked and get sweet HN points for posting an early PSA
Deactivate it, or at least deactivate AI training on copilot.
Even if you think you don't use it. If you ever commit something through the GitHub web UI, then GH autogenerates a commit message based on your commit data... so that would potentially be fed into the LLM training set, with the IP and security implications it may have.
As you may know, GitHub has detected a breach. This was originated by an employee installing a malicious VSCode extension (and no doubt escalated via other mechanisms.) It transpires that the source code of GitHub has been leaked and is available for sale through crime/privacy friendly networks.
The conclusion is that since source code can itself be analyzed by LLMs, there is a high possibility that vulns and privilege escalations may be discovered that would allow further attacks.
Here are some measures you can take:
1- Go through private repos and ensure there are no secrets. 2- Go through private repos, copy them to another system, and delete the repos. 3- Review privacy policies and settings, consider changing your account type to enterprise (I'd recommend going the opposite direction, but this is an option) 4- Consider not using github for a while. 5- If you are using non-essential Github software like GitHub CLI or vscode extensions, uninstall them. Learn to work with Git CLI if necessary. 6- Consider not downloading binaries from Github repos for a while. 7- Consider not downloading source code from GitHub for a while.
Other general recommendations can help as well: - Actually check hash digests, and ensure that the hash is distributed by other means than the code. - Consider using or strengthening alternative signature mechanisms like pgp. - Do not install stuff through package managers that don't review code. Consider writing the code yourself, read an RFC if necessary, it's ok. - Consider removing packages from the fishiest to the least. It's a chore, there's never time, but now is a good time as any. If a package is fishy, delete it and replace it with some simple code, if the package is not fishy, consider deleting it. - Consider planting a canary token in places that are likely to get hacked and get sweet HN points for posting an early PSA
Stay safe.
And what about copilot?
Deactivate it, or at least deactivate AI training on copilot.
Even if you think you don't use it. If you ever commit something through the GitHub web UI, then GH autogenerates a commit message based on your commit data... so that would potentially be fed into the LLM training set, with the IP and security implications it may have.
Discussion: https://news.ycombinator.com/item?id=48201316