Github services is under investigation after a series of reports on attacks against one of its infrastructures by running unauthorized crypto mining apps. Cybercriminals allegedly exploited some security flaws that could have been exploited to mine cryptos illicitly.
Attacks Exploit â€˜Github Actionsâ€™
According to The Record, a Dutch security engineer, Justin Perdok, detected a cyberattacker targeting repositories belonging to Github. Attacks have been taking place since November 2020, said the report.
Perdok pointed out that the series of attacks â€œabused a Github feature called Github Actions,â€ which allows users to automatically execute workflows and tasks only when a specific event happens and then pull the trigger on the repositories.
That said, threat actors are taking advantage of the repositories where Github Actions are already enabled. The Record provided details on how the attack takes place:
However, the engineer clarified that the attacker just needs to fill the â€œPull Requestâ€ to deploy the malicious workflows. Once itâ€™s loaded, Githubâ€™s systems will be cheated, as it will read the attackerâ€™s code and then download a crypto-mining software automatically.
100 Crypto Mining Apps Deployed in One Single Attack
But the malicious campaign seems to be powerful than thought, as Perdok told The Reported that he already detected hackers deploying almost 100 crypto-mining apps â€“ such as Srbminer â€“ in one single attack to mine multiple cryptocurrencies.
Still, the attack seems not to pose a danger to the usersâ€™ projects on the platform.
Github already commented on the matter, saying that theyâ€™re aware of the issue and â€œare actively investigating.â€ However, Perdok stated Github provided him that same comment last year when he reported the flaw.
What do you think about this flaw in Githubâ€™s infrastructure? Let us know in the comments section below.
Disclaimer: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article.