Millions of Repos on GitHub: A Looming Hijacking Crisis

Millions of Enterprise Software Repositories on GitHub Vulnerable to Repojacking

Name-Change Risks

Millions of enterprise software repositories on GitHub are susceptible to repojacking, a type of software supply chain attack. Researchers at Aqua Security have highlighted the vulnerability, which allows threat actors to redirect projects dependent on a specific repository to a malicious one instead. The issue stems from how GitHub handles dependencies when users or organizations change the name of a project or transfer its ownership. To prevent code dependencies from breaking, GitHub creates a link between the old and new repository names, redirecting all projects dependent on the original repository. However, if an organization fails to adequately protect the old username, an attacker could exploit it to create a trojanized version of the original repository. This would cause projects relying on the repo to unwittingly download dependencies from the malicious repository.

Widely Prevalent Issue

Aqua Security’s investigation found that millions of vulnerable repositories, including those owned by prominent companies like Google and Lyft, are present on GitHub. Attackers have easy access to tools like GHTorrent, which allows them to harvest the GitHub names of previously used repositories by organizations. Armed with these names, attackers can register the repository under the old username, recreate it, and deliver malware to any project that relies on it. Any project that directly references a GitHub repository becomes vulnerable if the repository’s owner changes or deletes the username associated with it.

Bypassing Protections

GitHub has made efforts to address this issue by preventing the creation of usernames and repositories that redirect to other projects. Additionally, GitHub implemented a mechanism to retire popular repository namespaces as another means of mitigating the threat. However, Aqua Security’s researchers discovered bypasses that render these defenses ineffective. GitHub‘s attempts to protect against repojacking were also previously circumvented by a vulnerability discovered by Checkmarx last year. The flaw, which Checkmarx referred to as “popular repository namespace retirement,” impacted renamed usernames and over 10,000 packages on package managers.

Advice and Recommendations

Companies and organizations can mitigate their exposure to repojacking by actively scanning their code, repositories, and dependencies for GitHub links. They should specifically check if these links directly refer to GitHub projects or if there are redirects pointing to repositories under different usernames or repo names. If such instances are found, organizations should promptly claim the available username to prevent attackers from usurping it. Aqua Security also advises organizations to maintain their old usernames on GitHub to reduce the risk of repojacking.

The Growing Concern for Software Supply Chain Security

Repojacking represents one facet of the broader challenge faced by enterprises in securing their software supply chains. Software supply chain attacks have gained heightened attention recently due to high-profile incidents like the SolarWinds attack and the Microsoft Exchange Server compromise. These incidents have underscored the need for robust supply chain security measures and heightened scrutiny of dependencies throughout the software development lifecycle.

The Philosopher’s Dilemma: Balancing Openness and Security

GitHub, as one of the world’s largest software development platforms, must grapple with the delicate balance between openness and security. The ability for anyone to create repositories and contribute to open source projects fosters collaboration, innovation, and knowledge sharing. However, as repojacking demonstrates, this openness can also provide avenues for malicious actors to exploit the trust placed in the community. GitHub‘s responsibility lies in implementing robust security measures without stifling the collaborative nature it is known for.

An Editorial: Protecting the Building Blocks of Our Digital World

The prevalence of vulnerable repositories on GitHub and the potential for repojacking should serve as a wake-up call for all stakeholders involved in software development. From individual developers to large corporations, securing the software supply chain must become a paramount concern. While GitHub and other platforms can implement security measures, it is ultimately the responsibility of organizations and individuals to actively protect their repositories and maintain a vigilant approach to the security of their dependencies.

As software continues to permeate every aspect of our daily lives and critical infrastructure, the protection of our digital building blocks becomes ever more crucial. Software developers must adopt secure coding practices, organizations must prioritize supply chain security, and platforms like GitHub must continue to innovate to provide stronger safeguards for their users. Only by collectively addressing these challenges can we ensure a safer and more resilient digital future.