Monday, November 4, 2024
HomeCyber Security NewsHackers Abuse GitHub Codespaces Feature to Host and Deliver Malware

Hackers Abuse GitHub Codespaces Feature to Host and Deliver Malware

Published on

Malware protection

Trend Micro researchers have recently demonstrated that malware and malicious scripts can be hosted and distributed within GitHub Codespaces by malicious actors through the use of port forwarding functionality.

GitHub Codespaces allows developers to quickly set up a workspace and start coding directly within minutes in a web browser, without having to worry about setup, configuration, and dependencies. 

This makes it much easier and faster to get started with a project, and it also reduces the need for developers to switch between different development environments.

- Advertisement - SIEM as a Service

Malware Server Hosted on GitHub Codespaces

GitHub Codespaces provide developers with cloud-hosted development environments that are easily accessible and can be quickly configured. 

This makes them an attractive target for malicious actors who can use them to quickly set up malicious web servers, which can be used to distribute malware or other malicious content without detection.

In this scenario, researchers have shown that by configuring a Codespace to act as a web server, an attacker could potentially use it to serve up malicious files or links that would be difficult for security systems to detect, because the traffic would appear to be coming from a legitimate source. 

GitHub Codespaces allows developers to create and manage development environments in the cloud directly from the GitHub platform. One of the key features of Codespaces is the ability for developers to forward TCP ports to the public internet. 

This means that developers can make their applications running on the Codespace available to external users by forwarding a specific port from the Codespace to the public internet. 

This is useful for setting up an environment for testing code, as well as for making applications accessible to others. By configuring the port as private, the URL can be shared with specific individuals, while public ports are accessible to anyone with the URL.

The main difference between a private and a public port forward is the security provided by the authentication requirement. A private port forward is much more secure since it limits access to only those who have the token or cookies, while a public port forward is open to anyone who knows the URL.

The following are possible actions an attacker could perform in theory:-

  • Run a simple Python web server
  • Upload malicious scripts or malware to their Codespace
  • Open a web server port on their VM
  • Assign it “public” visibility

Developers have the option to set the Codespaces port-forwarding system to HTTPS instead of HTTP by default. This will create the illusion that the URL is secure with respect to hackers.

The secure nature of GitHub allows threat actors to evade detection at a minimal cost since antivirus tools are less likely to raise alarms as GitHub is a trusted space.

Increasing the Attack’s Intensity

It is also possible for Trend Micro analysts to enhance their malware distribution operations by abusing the Dev Containers within GitHub Codespaces.

This tool is available to developers for quick deployment, sharing with others, and connecting to a VCS system. There are a number of things that an attacker can do by using a script, including the following:- 

  • Forward a port
  • Run a Python HTTP server
  • Download malicious files inside their Codespace

Now a web server with an open directory containing malicious files is created when the port’s visibility is set to public. 

An attacker can use the same URL for an entire month because GitHub’s policy is to automatically delete inactive codespaces after 30 days. However, in response to reports of security vulnerabilities, GitHub commits to investigating them. 

The company is aware of this report and plans to add a prompt to users when connecting to a codespace that asks them to confirm that they have trust in the owner.

Recommendations

Here below we have mentioned some best security practices that IT and security teams can implement to prevent future threats from abusing this platform:-

  • Whenever possible, use trusted code sources, such as extensions like VSCode extensions and GitHub repositories.
  • In order for developers to work with untrusted code properly, they should be aware of the repository they are working on and be careful when doing so.
  • Devcontainer configuration is based upon the use of container images, which should be recognized and maintained in accordance with the requirements.
  • For GitHub, you should always use passwords that are unique and strong.
  • Adding two-factor authentication to your account is a great way to increase its security.
  • In order to avoid credential leaks, it is necessary to avoid committing secrets and credentials publicly.

Network Security Checklist – Download Free E-Book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...