GitHub announced that attackers used stolen OAuth user access tokens to download private repositories from dozens of organizations, including npm. GitHub detected the activity on April 12, 2022. The tokens had been issued to Heroku and Travis CI applications. GitHub says the attacker did not modify any packages or reach user account data or credentials.
What did GitHub announce about the stolen OAuth tokens?
A cloud-based storage service, GitHub, has announced that threat actors manipulate OAuth user access tokens to commit data breaches from enterprise repos. With the detection of transactions by threat actors on April 12, 2022, it has been observed that the data of many organizations, including NPM, were seized using OAuth access tokens belonging to Heroku and Travis-CI applications.
What are OAuth access tokens?
OAuth access tokens, which let an app make API requests on behalf of a user, are often used by different services and applications to authorize access to designated parts of user data and communicate with each other without sharing credentials. This is based on the SSO (Single Sign-on) architecture, allowing single login to authorize other applications.
What did GitHub say about how the tokens were obtained?
GitHub authorities have issued a statement stating that OAuth access tokens will not be obtained by a data breach on GitHub and that these tokens are not stored directly in a usable format. Also, the company’s security researchers have detected that unauthorized access to the npm production infrastructure has been made through a compromised AWS API key. It is estimated that the threat actors obtained the API key using the OAuth access tokens captured. GitHub took action following an increase in activities using OAuth access tokens, preventing the use of such tokens.
What was affected, and what should GitHub users do?
According to the statement, some GitHub repositories have been compromised, but no changes have been made to the packages, and no user data or credentials have been accessed. GitHub has launched a detailed investigation to identify all users and organizations affected by the breach.
It is recommended that GitHub users who have the potential to be affected by this breach regularly review OAuth applications that they are authorized or have access to in their organization and periodically follow the security logs of the relevant organization to identify potential anomaly activities.