GitHub certs were stolen in a breach, don’t trust the blue checkmarks, and the encrypted
messaging platform Exclu gets seized!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for February 7, 2023 - this is your summary
of the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
Github’s code repositories were accessed by an unknown attacker, and code signing certificates
were stolen.
Github published an advisory on January 30th disclosing the breach and notifying customers
using two of their desktop applications: Desktop and Atom.
If you currently use either of the applications and noticed the app stopped working, it’s
because Github revoked the exposed certificates.
Versions affected include Desktop for Mac versions 3.1.2 through 3.0.2 and Atom versions
1.63.1 and 1.63.0.
The Windows version of Desktop is unaffected.
Github stated they discovered the unauthorized access on December 7.
While there was no risk to github.com services, the password protected code signing certificates
were stolen so they took that preventative measure of revoking them.
It appears the data was accessed one day before, on December 7, when the repos were atom, desktop,
and some other deprecated data was cloned by a compromised Personal Access Token associated
with a machine account.
Github says they have no evidence the certs were decrypted and the code repos that were
accessed didn’t have any customer data stored within them.
The choice to revoke them, though, was justified since code signing certificates are used to
verify code was actually developed by the signed organization.
An attacker could use these certs to “sign” malicious versions of those apps as github.
Users can update to the newest version of Desktop or download a previous version of
Atom to continue using these applications.
Microsoft disclosed last week that a phishing campaign was targeting organizations’ cloud
environments by way of fake Microsoft Partner Network accounts using malicious OAuth apps.
In their advisory, they explained that on December 15th, Microsoft discovered an attacker
impersonating real companies while enrolling in the Microsoft Cloud Partner Program, which
used to be called Microsoft Partner Network.
They used these fake accounts to add verified publisher OAuth app registrations created
in Azure AD.
Those were then used in attacks called “consent phishing campaigns” which target and trick
users into granting permissions to the fraudulent apps.
Affected customers were alerted via email and all fraudulent applications were disabled.
Microsoft also took steps to improve the procedures for approving orgs into the MCPP.
By becoming a “verified publisher” with Microsoft, an org receives a blue checkmark
by their name and if targeted by an attacker, this can be incredibly deceptive since the
name of the org would be identical to legitimate ones, with the attackers even linking the
TOS to legitimate sites.
Proofpoint went into further details on these attacks via their own advisory, posted on
January 31.
They explain these attacks could impact orgs in a variety of ways, including data exfiltration,
brand abuse, and delegating permissions over compromised mailboxes, calendars, and meetings.
Proofpoint and Microsoft recommended using caution when orgs grant access to third party
OAuth apps even if they look like they’re verified.
Users can be restricted to only apps with low risk permissions and cloud environments
should be proactively protected.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to Veronica, Sunny, Guardian452, Robert, James and Mark for being a part of
the Smores at Patreon.com/shannonmorse.
This year I will be migrating all perks and early access content to my Morse Code patreon
and combining the two accounts to make releases and perks for y'all more efficient.
You can get ahead of this change by moving your pledge to patreon.com/ShannonMorse.
You’ll still get all the perks associated with this Patreon, with the added benefits
of my Morse Code perks for the same membership prices.
For annual ThreatWire pledges, I’d recommend keeping your annual pledge active til closer
to your resubscription date then switching over.
Let me know if you have questions!
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about a Exclu!
According to the Dutch Police, two major investigations which began in September 2020 and April 2022
led to searches and arrests in several countries and the dismantling of an encrypted communications
platform called Exclu.
The news was announced on Friday of last week.
Police acted on 79 searches which happened in Germany, Belgium and the Netherlands, to
arrest 42 people who’re believed to be a part of criminal organizations that have ties
to drug lab operations, narcotics, firearms and more.
Two of those arrested are suspected of owning and managing Exclu.
Law enforcement in the countries of Italy, Sweden, the Netherlands, France, and Germany
were involved in the takedown as well as Europol and Eurojust.
This encrypted communications platform would sell six month subscriptions to its service
for 800 euros and had about 3000 users.
In the Netherlands, the platform had 750 users alone, and Dutch police arrested 11 people
in their jurisdiction.
The law enforcement announcement explains that police were reading Exclu messages for
the last five months, leading to authorities now having ALL communication data.
Some users were legitimately using the platform for privacy, like notaries, doctors, and investigators,
so they’re now being advised to contact police to request data removal since police
seized the Exclu servers.
Law enforcement has continuously targeted encrypted communications platforms for criminal
takedowns.
While these platforms are often advertised as encrypted and private, they’re only as
private as the person you’re talking to.
I'm Shannon Morse, I'll see you on the Internet!