www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
Submitted URL: https://www.bleepingcomputer.com//news/security/hackers-can-use-github-codespaces-to-host-and-deliver-malware/
Effective URL: https://www.bleepingcomputer.com/news/security/hackers-can-use-github-codespaces-to-host-and-deliver-malware/
Submission: On January 19 via api from US — Scanned from DE
Effective URL: https://www.bleepingcomputer.com/news/security/hackers-can-use-github-codespaces-to-host-and-deliver-malware/
Submission: On January 19 via api from US — Scanned from DE
Form analysis 4 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/hackers-can-use-github-codespaces-to-host-and-deliver-malware/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/hackers-can-use-github-codespaces-to-host-and-deliver-malware/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" spellcheck="false" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" spellcheck="false" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/hackers-can-use-github-codespaces-to-host-and-deliver-malware/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
*
*
* News
* Featured
* Latest
* Microsoft: Windows 11 apps might not start after system restore
* Hackers can use GitHub Codespaces to host and deliver malware
* Hackers push malware via Google search ads for VLC, 7-Zip, CCleaner
* Over 4,000 Sophos Firewall devices vulnerable to RCE attacks
* Exploit released for critical ManageEngine RCE bug, patch now
* PayPal accounts breached in large-scale credential stuffing attack
* New 'Blank Image' attack hides phishing scripts in SVG files
* Ransomware profits drop 40% in 2022 as victims refuse to pay
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* Remove the Theonlinesearch.com Search Redirect
* Remove the Smartwebfinder.com Search Redirect
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to open a Windows 11 Command Prompt as Administrator
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Hackers can use GitHub Codespaces to host and deliver malware
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditReddit11Share to Hacker NewsHacker NewsShare
to EmailEmail
*
HACKERS CAN USE GITHUB CODESPACES TO HOST AND DELIVER MALWARE
By
BILL TOULAS
* January 17, 2023
* 02:53 PM
* 0
Researchers have demonstrated how threat actors can abuse the GitHub Codespaces'
port forwarding' feature to host and distribute malware and malicious scripts.
GitHub Codespaces allows developers to deploy cloud-hosted IDE platforms in
virtualized containers to write, edit, and test/run code directly within a web
browser.
Since it became widely available in November 2022, GitHub Codespaces has become
a popular choice among developers who prefer it for its pre-configured,
container-based environment equipped with all the necessary tools and
dependencies needed for their projects.
1/1 Skip Ad Continue watching after the ad Visit Advertiser websiteGO TO PAGE
PLAY Top Stories Video Settings Full Screen About Connatix V215756 Read More
Read More Read More Read More Read More Read More Microsoft investigates bug
behind unresponsiveWindows Start Menu
USING GITHUB CODESPACES AS A MALWARE SERVER
In a new report by Trend Micro, researchers demonstrate how GitHub Codespaces
can easily be configured to act as a web server for distributing malicious
content while potentially avoiding detection as the traffic comes from
Microsoft.
GitHub Codespaces allows developers to forward TCP ports to the public so
external users can test or view the applications.
When forwarding ports in a Codespace VM, the GitHub feature will generate an URL
to access the app running on that port, which can be configured as either
private or public.
A private port forward requires authentication in the form of a token or cookies
to access the URL. However, a public port is accessible to anyone who knows the
URL without requiring authentication.
Port visibility setting on Codespaces
Source: Trend Micro
This GitHub feature gives developers flexibility in code demonstrations, but
Trend Micro says attackers today can easily abuse it to host malware on the
platform.
Theoretically, an attacker could run a simple Python web server, upload
malicious scripts or malware to their Codespace, open a web server port on their
VM, and assign it "public" visibility.
The generated URL can then be used to access the hosted files, whether for
phishing campaigns or to host malicious executables downloaded by other malware.
This is precisely how threat actors abuse other trustworthy services such as
Google Cloud, Amazon AWS, and Microsoft Azure for malware distribution
campaigns.
"To validate our hypothesis of threat modeling abuse scenario, we ran a
Python-based HTTP server on port 8080, forwarded and exposed the port publicly,"
reads the Trend Micro report.
"In the process, we easily found the URL and the absence of cookies for
authentication."
The analysts say that while HTTP is used by default in the Codespaces
port-forwarding system, developers can set it to HTTPS, increasing the illusion
of security for the URL.
Because GitHub is a trusted space, antivirus tools are less likely to raise
alarms so that the threat actors can evade detection at a minimal cost.
Codespaces abuse attack diagram (Trend Micro)
FURTHERING THE ATTACK
Trend Micro analysts also explore abusing Dev Containers in GitHub Codespaces to
make their malware distribution operations more efficient.
A "dev container" in GitHub Codespaces is a pre-configured container that
contains all the necessary dependencies and tools for a specific project.
Developers can use it for quick deployment, share it with others, or connect via
VCS.
An attacker can use a script to forward a port, run a Python HTTP server, and
download malicious files inside their Codespace.
Next, the port's visibility is set to public, which creates a webserver with an
open directory that serves malicious files to targets.
Trend Micro created a proof of concept (PoC) for this, using a 100-second delay
after the URL is accessed before the web server is deleted.
BleepingComputer was able to replicate the creation of a "malicious" webserver
using Codespaces in less than 10 minutes, with zero experience with the feature.
Running a web server on a GitHub Codespaces VM
Source: BleepingComputer
"Using such scripts, attackers can easily abuse GitHub Codespaces in serving
malicious content at a rapid rate by exposing ports publicly on their codespace
environments. Since each created Codespace has a unique identifier, the
subdomain associated is unique as well," explains Trend Micro in the report.
"This gives the attacker enough ground to create different instances of open
directories."
GitHub's policy is that inactive codespaces are automatically deleted after 30
days, so attackers can use the same URL for an entire month.
While there is no known abuse of GitHub Codespaces at this time, the report
highlights a realistic possibility, as threat actors generally prefer to target
"free to use" platforms that are also trusted by security products.
BleepingComputer has contacted GitHub to comment on Trend Micro's report, but we
are still waiting for a response.
--------------------------------------------------------------------------------
Update 1/18 - A GitHub spokesperson has sent BleepingComputer the following
comment on the above:
> GitHub is committed to investigating reported security issues. We are aware of
> this report and plan to add a prompt to users to validate that they trust the
> owner when connecting to a codespace.
>
> We recommend users of GitHub Codespaces follow our guidelines to maintain
> security and minimize risk of their development environment.
RELATED ARTICLES:
Hackers abuse Google Ads to spread malware in legit software
Gain valuable skills by learning to code with this C course bundle
Malicious ‘Lolip0p’ PyPi packages install info-stealing malware
Android TV box on Amazon came pre-installed with malware
VSCode Marketplace can be abused to host malicious extensions
* Codespaces
* Coding
* Distribution
* GitHub
* Malware
* Web Server
* Facebook
* Twitter
* LinkedIn
* Email
*
BILL TOULAS
Bill Toulas is a technology writer and infosec news reporter with over a decade
of experience working on various online publications. An open source advocate
and Linux enthusiast, is currently finding pleasure in following hacks, malware
campaigns, and data breach incidents, as well as by exploring the intricate ways
through which tech is swiftly transforming our lives.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* MSI accidentally breaks Secure Boot for hundreds of motherboards
* Over 4,000 Sophos Firewall devices vulnerable to RCE attacks
FOLLOW US:
*
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2023 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT