Since the moment it was founded in 2008 by Tom Preston-Werner, Chris Wanstrath, and PJ Hyett, GitHub has become one of the leading git hosting services in the world. Just check the numbers! Every day the service can boast of 7K people who start pushing their very first repository, 4K of those who join the GitHub community, and incredible 80K public repositories are updated by DevOps from different, even the most remote parts of our planet.
Also Read: 10 Free Instagram Reels Video Download Online
It sounds incredible! Now let’s add another statistic – every 11 seconds ransomware hits its target and some bad actor can encrypt, delete or modify someone’s vital data. Let’s mention the most recent cases when ransomware in the GitHub environment was noticed.
GitHub and ransomware: track of spotted events
2019
In 2019 a group of malware researchers from Trend Micro noticed a tricky malware that was leveraging GitHub and Slack for C&C communications. Later it was called SLUB and as it appeared afterwards the attackers were mostly interested in files with the HWP extension associated with a Korean word processor. After Trend Micro shared its findings with GitHub and Slack, the companies quickly removed all the related files and channels. But what about the users whose data has been compromised?
2020
In 2020 the GitHub’s Security Incident Response Team issued a notice that a set of GitHub repositories was infected with some malicious code. Its target were developers who usually used open-source Java projects. The malware infected the integrated DevOps environment and affected all the developed projects. Was it disastrous for users whose data was infected?
2022
In August 2022 Stephan Lucy, a GitHub developer, wrote in his twitter about the massive widespread malware that attacked GitHub: “Currently over 35K repositories are infected.” As the service found out afterwards more than 13,000 search results of those 35,000+ were from a single repo called “redhat-operator-ecosystem”. The malevolent actors cloned and infected the repos with malware and then re-uploaded them to GitHub. Moreover, the repositories not only exfiltrated the user’s GitHub environment variables, it included a one-line backdoor that permitted the hostile actors to control the infected systems remotely.
Also Read: 10 Free Instagram Reels Video Download Online
Though, to deal with the issue GitHub removed all the traces of that code which was built to steal critical data, including credentials, environment variables, passwords, documents, ect. Also they issued another notification: “No repositories were compromised. Malicious code was posted to cloned repositories, not the repositories themselves. The clones were quarantined and there was no evident compromise of GitHub or maintainer accounts.” Isn’t it better to know that you can always restore your data from any point in time without guessing if it is compromised or not?
Is there an opportunity to withstand ransomware in GitHub?
All the situations connected to ransomware can be solved. How? The answer is simple – backup. To understand what it should include and how it works it’s better to look at the examples.
Scenario # 1
Let’s look at the situation when you don’t have a backup considering git is a backup itself… Small hint – it is not. One day ransomware hits your data in a GitHub repository. You can’t access any of your repos, wikis, or other metadata – they are encrypted. Instead you see just a small notice with a demand to pay a ransom. What is the solution? You might think about paying the mentioned sum if the data is vital to you and you don’t want to lose it. However, is there an assurance that you will get all your data back without any modification, deletion or encryption? Unfortunately, no… about 4% of those who paid the ransom could never get access to their data back.
Scenario # 2
Let’s look at the situation when you understand that git is not a backup. So, you delegated one of your DevOps to write a backup script and perform it from time to time. Then, once a ransomware hits your GitHub data, you know that you have a backup. You can delegate your developer with another task to write a recovery script.
Also Read: 8 Best Website to Download Movies for Free
You and your team wait for a recovery for some time – and probably, it’s the first time you got this script really tested. Though, let’s don’t forget that “time is money.” Finally the script is ready and your data is recovered (is it?). But… What a surprise, your data is modified, encrypted or deleted. Why? Because it could be infected by malware before you even noticed it and when you backed up the data to your repository, the ransomware spread in your storage. As a result all data is infected and a malevolent actor is waiting for you to pay the ransom.
Scenario # 3
Now let’s consider the situation when you use a third-party GitHub backup solution, like GitPortect.io. The same situation: your data is infected, as you have ransomware in your GitHub account and all your GitHub environment is inaccessible. Just run your backup copy without any worries that your storage is infected. Why? In case when you share the responsibility to protect your data with a professional third-party backup software vendor, you get turnkey technology with features like immutable, WORM-compliant storage that keeps your backup copies non-executable, point-in-time recovery, AES encryption, and more. Thus, even if your backup copy was infected, the malware won’t spread on the storage and you can still recover the previous copy, from a very specific point in time. With Disaster Recovery technologies that come in paired with backup software, you can eliminate downtime and ensure continuous workflow.
What are the main features your anti-ransomware GitHub backup solution should include?
So, when you plan your DevOps backup strategy, it’s worth considering which backup features are really valuable for your business assurance. To enhance your protection and withstand any ransomware attack one should keep the following practices in mind:
- zero-knowledge encryption when no one but you knows the encryption key.
- WORM-compliant storage when a file is written once but read a number of times.
- Secure Password Manager which keeps all your critical data well-protected.
- Point-in-time recovery, when you can run not only the latest copy, but can pick up exactly the one you need.
- Replication between many storages (to comply with the 3-2-1 rule)
- Disaster Recovery Technology which forecasts any disaster scenario and ensures workflow stability.
Takeaway
GitHub is a leading git hosting platform that attracts users with its wide community, ease of use, and possibility for DevOps to cooperate remotely easily. It, in its turn, attracts hostile actors to develop more and more malicious programming. Nowadays ransomware has become a data disease, which is difficult and expensive to remove. Still, one of the most alarming cyber-myths is one which ransomware doesn’t hit SaaS and cloud-native services! Busted! The attackers follow the crowd – they are the most active in places and communities that gather a large number of users and disputably, GitHub is one of them.
It is always better to use preventive measures than to put up with the consequences. GitHub backup can become that preventive measure that will guarantee an enterprise’s continuous workflow and will help save its budget. Small investment for peace of mind, right?
