GitHub revealed today that an attacker is using stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories.
Since this campaign was first seen on April 12, 2022, the threat actor has already accessed and stolen data from dozens of victim organizations using Heroku and Travis-CI-maintained OAuth apps, including npm.
“The applications maintained by these integrators were used by GitHub users, including GitHub itself,” revealed today Mike Hanley, Chief Security Officer (CSO) at GitHub.
“We do not believe that the attacker obtained these tokens through a compromise of GitHub or its systems because those tokens are not stored by GitHub in their original, usable formats.
“Our analysis of other behavior by the threatening actor suggests that the actors may be mining the downloaded private repository content that the stolen OAuth token had access to for secrets that could be used to pivot into other infrastructure.”
According to Hanley, the list of affected OAuth applications includes:
- Heroku Dashboard (ID: 145909)
- Heroku Dashboard (ID: 628778)
- Heroku Dashboard – Example (ID: 313468)
- Heroku Dashboard – Classic (ID: 363831)
- Travis CI (ID: 9216)
GitHub Security identified the unauthorized access to GitHub’s npm production infrastructure on April 12, after the attacker used a compromised AWS API key.
The attacker probably obtained the API key after downloading several private npm repositories using stolen OAuth tokens.
“When we discovered the wider theft of third-party OAuth tokens not stored by GitHub or npm on the evening of April 13, we immediately took steps to protect GitHub and npm by revoking tokens associated with GitHub and npm’s internal use of these compromised applications. ” Hanley added.
Impact on the npm organization includes unauthorized access to private GitHub.com repositories and “potential access” to npm packages on AWS S3 repositories.
GitHub has revealed evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact on GitHub, npm and our users. https://t.co/eB7IJfJfh1
– GitHub Security (@GitHubSecurity) April 15, 2022
GitHub’s private repositories are not affected
While the attacker was able to steal data from the compromised repositories, GitHub believes none of the packages were modified and no user account data or credentials were accessed in the incident.
“npm uses completely separate infrastructure from GitHub.com; GitHub was not affected in this initial attack,” Hanley said.
“While the investigation continues, we have not found evidence that other GitHub-owned private repos were cloned by the attacker using stolen third-party OAuth tokens.”
GitHub works to notify all affected users and organizations as they are identified with additional information.
You should review your organization’s audit logs and user account security logs for abnormal, potentially malicious activity.
You can find more information about how GitHub responded to protect its users and what customers and organizations need to know in the security warning released Friday.