Attackers Can Abuse GitHub Codespaces for Malware Delivery

guest · Jan 17, 2023

By Ionut Arghire - January 17, 2023

A GitHub Codespaces feature meant to help with code development and collaboration can be abused for malware delivery, Trend Micro reports.
Click to expand...

Generally available since November 2022, following a private preview period, GitHub Codespaces is a free cloud-based integrated development environment (IDE) that allows developers to create, edit, and run code in their browsers via a container-based environment that runs in a virtual machine (VM).

One of the features that GitHub Codespaces provides enables developers to share forwarded ports from the VM, either privately or publicly, for real-time collaboration purposes.
Click to expand...

The private port can only be accessed via its URL, while publicly shared ports can be accessed by anyone with the URL, without any form of authentication.

According to Trend Micro, this collaboration feature can be abused by threat actors with accounts on GitHub to host malicious content, including scripts, ransomware, and other types of malware.

“Moreover, the barriers of costs in creating a Codespaces environment are now lower compared to creating a cloud service provider (CSP) account where you need a credit card to become a subscriber, be it in Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and many others,” Trend Micro notes.
Click to expand...

According to Trend Micro, an attacker could build a simple script to repeatedly create a codespace with a publicly exposed port and use it to host malicious content – essentially a webserver with an open directory containing malware – and set it to automatically delete itself after the URL has been accessed.

“Using such scripts, attackers can easily abuse GitHub Codespaces in serving malicious content at a rapid rate by exposing ports publicly on their codespace environments. Since each created codespace has a unique identifier to it, the subdomain associated is unique as well. This gives the attacker enough ground to create different instances of open directories,” Trend Micro says.
Click to expand...

Trend Micro: Abusing a GitHub Codespaces Feature For Malware Delivery

By: Nitesh Surana, Magno Logan - January 16, 2023
Proof of Concept (POC): We investigate one of the GitHub Codespaces’ real-time code development and collaboration features that attackers can abuse for cloud-based trusted malware delivery. Once exploited, malicious actors can abuse legitimate GitHub accounts to create a malware file server.
Click to expand...

Log in or Sign up

Attackers Can Abuse GitHub Codespaces for Malware Delivery

guest Guest

Log in or Sign up

Attackers Can Abuse GitHub Codespaces for Malware Delivery

guest Guest

Useful Searches