Re:Ask HN: Was GitHub Hacked or Me?
by scottndecker on Wednesday April 03, 2019 @03:42PM
(#19566554)
Son of a biscuit! This is exactly what happened. They said I could have my 7 private repos without a Pro account so I downgraded and didn't realize it shut down my gh-pages websites. Then this schmuck comes along and steals them. THANK YOU TO EVERYONE WHO IS REPORTING THIS!!
Re:Ask HN: Was GitHub Hacked or Me?
by chrisweekly on Wednesday April 03, 2019 @10:20PM
(#19568840)
Thank you for "son of a biscuit"! Best pseudo-swear since "Shut the front door".
In french my wife uses "lutin en herbe" (or just "lutin") instead of "putain de merde"
Re:Ask HN: Was GitHub Hacked or Me?
by tendencydriven on Thursday April 04, 2019 @06:51AM
(#19570802)
Google translate says "budding goblin" ... I'm just going to use that in English
Re:Ask HN: Was GitHub Hacked or Me?
by applecrazy on Wednesday April 03, 2019 @03:14PM
(#19566304)
Yes. This is what I just discovered. OP here's the malicious github account, so we can get it banned:
https://github.com/OnyonCapitaly
I found a repo with your domain:
https://github.com/OnyonCapitaly/confidencetoexplore.com
edit: just reported them, but you should too OP.
Re:Ask HN: Was GitHub Hacked or Me?
by applecrazy on Wednesday April 03, 2019 @06:42PM
(#19567840)
Aaaand it’s down! Good job Github and everyone who helped.
Hope this helped, OP
The script kiddie will just signup for another account and "hack" the same sites again.
At least now they have to go through that effort again
Does GitLab have this issue? Don't they offer all this for free, unlike GitHub?
I don't know if they handle this case better specifically, but I found almost all GitLab page functionality is better than GitHub - plus it's more generic, you can wire any static page generator into the built-in CI/CD, not just limited to jekyll or doing it yourself.
Re:Ask HN: Was GitHub Hacked or Me?
by therealmarv on Wednesday April 03, 2019 @09:26PM
(#19568610)
GitLab requires you to put a txt record with a verification code in your custom private domain DNS to verify ownership.
TL;DR no, GitLab does not have that issue.
Re:Ask HN: Was GitHub Hacked or Me?
by gitlab-security on Wednesday April 03, 2019 @09:59PM
(#19568754)
Confirming the previous poster's comment on GitLab Pages domain ownership verification functionality, which was rolled out in February of 2018. https://about.gitlab.com/2018/02/05/gitlab-pages-custom-doma...
Re:Ask HN: Was GitHub Hacked or Me?
by scottndecker on Wednesday April 03, 2019 @03:43PM
(#19566566)
Thank you! This is nuts that this can happen and someone would do such a thing. Stupid.
You are awesome. Good work!
Re:Ask HN: Was GitHub Hacked or Me?
by applecrazy on Thursday April 04, 2019 @12:03AM
(#19569221)
Thanks! This is the first time I've done this kind of internet sleuthing. It's a fun experience.
Re:Ask HN: Was GitHub Hacked or Me?
by sarcasmatwork on Wednesday April 03, 2019 @03:27PM
(#19566420)
Reported too...
Re:Ask HN: Was GitHub Hacked or Me?
by scottndecker on Wednesday April 03, 2019 @03:43PM
(#19566567)
Thank you!
Re:Ask HN: Was GitHub Hacked or Me?
by morpheuskafka on Wednesday April 03, 2019 @05:23PM
(#19567368)
GitHub recebtly introduced a domain verification system for an unrelated feature, they should really integrate it with Pages.
Re:Ask HN: Was GitHub Hacked or Me?
by dragonwriter on Wednesday April 03, 2019 @09:34PM
(#19568649)
That thread was 54 days ago, and the flaw was being exploited and was reported to GH then.
Shouldn't they, I don't know, do something beyond banning accounts caught exploiting this?
That thread is 2months old and GitHub/Microsoft still hasn't closed this security hole.
Re:Ask HN: Was GitHub Hacked or Me?
by applecrazy on Wednesday April 03, 2019 @06:44PM
(#19567852)
They should at least flag accounts with an unusually high number of custom domains. Seems easy to do IMO.
Yes, I got my GitHub page 'hijacked' in a similar way some time ago when I switched the repo to private (when GitHub announced free private repos for regular account).
Quick response from GitHub after raising a report and got my CNAME back after going through the domain ownership verification with them.
The main gist is that GitHub doesn't require proof of ownership in order to set a custom domain.
This means that if your GitHub Pages configurations are incorrect for any reason (for example, that user switched from a Pro to a regular account and lost the ability to have a GH page on a private repo), another user can come along and claim your page (confidencetoexplore.com) as the custom domain for that repo.
My bet would be that this happened to you. As another user in that thread mentioned, report them: https://github.com/contact/report-abuse