adeliktas

IT-Sec bits&bytes for packets, mem and cpu Linux and Win. Network and IT-Sec., RE. & Sys.

[Ax Sharma @Ax_Sharma]

A GitHub flaw lets attackers upload executables that appear to be hosted on a company's official repo, such as Microsoft's—without the repo owner knowing anything about it.

The following URLs, for example, make it seem like these ZIPs are present on Microsoft's source code repo:

https://github[.]com/microsoft/vcpkg/files/14125503/Cheat.Lab.2.7.2.zip
https://github[.]com/microsoft/STL/files/14432565/Cheater.Pro.1.6.0.zip

But they are not. These ZIPs are #malware.

An attacker, while commenting on any GitHub commit/PR, can "attach" a file that gets assigned a URL slug containing the name of the repo where the comment was made. Even if the comment is never actually posted or later deleted by the attacker, the link to the file remains live!

And, the repo owner (Microsoft in this case) would have no knowledge of or control over such files.

Threat actors have been abusing this flaw to distribute malicious executables under the false pretense that these are coming from credible organizations' code repos.

[adeliktas @adeliktasde]

Verifying myself: I am adeliktas on https://t.co/uzHMPRRcia. uJ3gWcbQrv3zhtMJReqWqkr2ysyxfcQQfzDQ / https://t.co/ggPZREK0E5