An attacker removes GitHub code repositories to demand Bitcoin ransom

An attacker would have entered GitHub accounts to erase the code repositories and then ask bitcoin ransom for his owners. The attacker threatens to make the code public or to use it for his own purposes.

According to ZDNet, the attack hit at least 392 different GitHub repositories and degraded them with a ransom note asking for 0.1 BTC ($ 558) and an email proving that the payment was made.

The attack would also affect code repositories in services similar to GitHub, including Bitbucket and GitLab. The attacker would have succeeded in removing the code from these repositories by accessing accounts using weak pbadwords or lost identifiers via separate services.

In a statement, GitHub said:

At this time, it appears that the account identification information of some of our users has been compromised as a result of unknown exposures to third parties. We work with affected users to secure and restore their accounts.

Talking to Motherboard, a security researcher at Atlbadian, owner of Bitbucket, revealed that a thousand users may have been affected by these attacks. At present, it is unclear whether valuable cod have been affected because many repositories are public and there are various largely unused and poor projects on GitHub.

In a security advisory, Bitbucket said it was about to restore the affected repositories in the near future, while one victim said he managed to recover the affected code by "accessing a hash." of confirmation".

Currently, the bitcoin address of the hackers does not seem to have received ransom, because at the time of going to press, it had received a transaction of 0.0005 BTC, which is the total balance. To protect its users, GitHub and other services recommend the use of two-factor authentication methods.