Friday, March 29, 2024

Hackers Abuse GitHub Codespaces Feature to Host and Deliver Malware

Trend Micro researchers have recently demonstrated that malware and malicious scripts can be hosted and distributed within GitHub Codespaces by malicious actors through the use of port forwarding functionality.

GitHub Codespaces allows developers to quickly set up a workspace and start coding directly within minutes in a web browser, without having to worry about setup, configuration, and dependencies. 

This makes it much easier and faster to get started with a project, and it also reduces the need for developers to switch between different development environments.

Malware Server Hosted on GitHub Codespaces

GitHub Codespaces provide developers with cloud-hosted development environments that are easily accessible and can be quickly configured. 

This makes them an attractive target for malicious actors who can use them to quickly set up malicious web servers, which can be used to distribute malware or other malicious content without detection.

In this scenario, researchers have shown that by configuring a Codespace to act as a web server, an attacker could potentially use it to serve up malicious files or links that would be difficult for security systems to detect, because the traffic would appear to be coming from a legitimate source. 

GitHub Codespaces allows developers to create and manage development environments in the cloud directly from the GitHub platform. One of the key features of Codespaces is the ability for developers to forward TCP ports to the public internet. 

This means that developers can make their applications running on the Codespace available to external users by forwarding a specific port from the Codespace to the public internet. 

This is useful for setting up an environment for testing code, as well as for making applications accessible to others. By configuring the port as private, the URL can be shared with specific individuals, while public ports are accessible to anyone with the URL.

The main difference between a private and a public port forward is the security provided by the authentication requirement. A private port forward is much more secure since it limits access to only those who have the token or cookies, while a public port forward is open to anyone who knows the URL.

The following are possible actions an attacker could perform in theory:-

  • Run a simple Python web server
  • Upload malicious scripts or malware to their Codespace
  • Open a web server port on their VM
  • Assign it “public” visibility

Developers have the option to set the Codespaces port-forwarding system to HTTPS instead of HTTP by default. This will create the illusion that the URL is secure with respect to hackers.

The secure nature of GitHub allows threat actors to evade detection at a minimal cost since antivirus tools are less likely to raise alarms as GitHub is a trusted space.

Increasing the Attack’s Intensity

It is also possible for Trend Micro analysts to enhance their malware distribution operations by abusing the Dev Containers within GitHub Codespaces.

This tool is available to developers for quick deployment, sharing with others, and connecting to a VCS system. There are a number of things that an attacker can do by using a script, including the following:- 

  • Forward a port
  • Run a Python HTTP server
  • Download malicious files inside their Codespace

Now a web server with an open directory containing malicious files is created when the port’s visibility is set to public. 

An attacker can use the same URL for an entire month because GitHub’s policy is to automatically delete inactive codespaces after 30 days. However, in response to reports of security vulnerabilities, GitHub commits to investigating them. 

The company is aware of this report and plans to add a prompt to users when connecting to a codespace that asks them to confirm that they have trust in the owner.

Recommendations

Here below we have mentioned some best security practices that IT and security teams can implement to prevent future threats from abusing this platform:-

  • Whenever possible, use trusted code sources, such as extensions like VSCode extensions and GitHub repositories.
  • In order for developers to work with untrusted code properly, they should be aware of the repository they are working on and be careful when doing so.
  • Devcontainer configuration is based upon the use of container images, which should be recognized and maintained in accordance with the requirements.
  • For GitHub, you should always use passwords that are unique and strong.
  • Adding two-factor authentication to your account is a great way to increase its security.
  • In order to avoid credential leaks, it is necessary to avoid committing secrets and credentials publicly.

Network Security Checklist – Download Free E-Book

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles