Feeds

GitHub reinstates Russian who hacked site to expose flaw

Developer was just trying to help...

Protecting against web application threats using SSL

GitHub has reinstated the account of a Russian software developer who discovered a series of security flaws involving the code repository that he eventually shamed the site into fixing over the weekend.

Egor Homakov discovered a cryptographically-related security bug on GitHub that allowed attackers to gain administrator access to projects such as Ruby on Rails and scores of others. GitHub itself uses a vulnerable Ruby on Rails application framework, the root cause of the problem, leaving the code repository open to attack. Homakov reported this so-called mass assignment vulnerability on the Rails repository.

Administrators deleted the thread on the bug. Homakov reopened a ticket on the flaw (which involves a failure to failure to properly check incoming form parameters), only to be more or less ignored again.

Tired of these shenanigans, Homakov exploited the bug to add his public key to the Rails project on GitHub, making him an administrator of the project. At this point he could have deleted project histories – or worse. Instead, he overwrote timestamps to post a message under the guise of habitually drunken kleptomaniac robot Bender, of Futurama and e-vote hacking fame, that was dated 1,000 years in the future. He also pushed a new (innocuous) file onto the Rails repository.

Homakov explains what he did in a blog post entitled "Egor, stop hacking GH".

Stirred into action, GitHub acted quickly to suspend Homakov over the harmless hack, which it initially treated as a full-on security attack. It also fixed the vulnerability that had allowed Homakov's hijinks, which would have been avoided if his initial reports were taken seriously.

After reviewing Homakov's activity, wiser counsel prevailed and GitHub restored the Russian software developer's account. In fairness, the suspension only lasted a few hours, and GitHub's initial caution was understandable. A blog post by GitHub explained it was Homakov's actions in exploiting flaws to upload his personal key and make changes to the rails project that earned him a spell in the sin-bin.

There has been some confusion over today's security vulnerability and our policy on responsible disclosure and account suspension that I'd like to clear up.

Three days ago, user @homakov opened an issue on rails/rails about the prevalence of the mass-assignment vulnerability. Two days ago he responsibly disclosed a security vulnerability to us and we worked with him to fix it in a timely fashion. Today, he found and exploited the public key form update vulnerability without responsible disclosure. For this reason we temporarily suspended his account for violation of section A8 of the GitHub Terms of Service pending a full investigation into what happened. Now that we've had a chance to review his activity, and have determined that no malicious intent was present, @homakov's account has been reinstated.

GitHub took the opportunity to refer interested parties to its code on vulnerable disclosure. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.