News for hackers. Stuff that matters.

A comment on Claude 4 and GitHub MCP will leak your private GitHub repositories. Parent comment

Re:Claude 4 and GitHub MCP will leak your private GitHub rep... by serbuvlad on Tuesday May 27, 2025 @10:54AM (#44107573)
It's singed by a key that's obtained from a URL owned by the same person. Sure, you can't attack devices already using the repo, but new installs are fair game.

And are URLs (w/ DNSSEC and TLS) really that easy to hijack?

[ Parent | on HN ]
Re:Claude 4 and GitHub MCP will leak your private GitHub rep... by tart-lemonade on Tuesday May 27, 2025 @04:23PM (#44110380)
> And are URLs (w/ DNSSEC and TLS) really that easy to hijack?

During the Google Domains-Squarespace transition, there was a vulnerability that enabled relatively simple domain takeovers. And once you control the DNS records, it's trivial to get Let's Encrypt to issue you a cert and adjust the DNSSEC records to match.

https://securityalliance.notion.site/A-Squarespace-Retrospec...

[ Parent | on HN ]