Hacker claims to have breached Microsoft's GitHub private repos

guest · May 6, 2020

Hacker claims to have breached Microsoft's GitHub private repos
May 6, 2020
https://www.bleepingcomputer.com/ne...ave-breached-microsofts-github-private-repos/

A hacker claims to have stolen over 500GB of data from Microsoft's private GitHub repositories, BleepingComputer has learned.

This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories.
The individual told us that they then downloaded 500GB of private projects and initially planned on selling it, but has now decided to leak it for free

Based on the file stamps in the leaked files, the breach may have occurred on March 28th, 2020.
Click to expand...

Private repositories leaked
As a teaser, the hacker offered 1GB of files on a hacker forum for registered members to use site 'credits' to gain access to the leaked data.
In a directory listing and samples of other private repositories sent to BleepingComputer, the stolen data appears to be mostly code samples, test projects, an eBook, and other generic items.
Click to expand...

Some private repositories look a bit more interesting such as ones named some 'wssd cloud agent', a The Rust/WinRT language projection', and a 'PowerSweep' PowerShell project.
Microsoft employee Sam Smith replied to Under the Breach's tweet stating that he thought the leak was fake as "Msft has a “rule” that GitHub repos must be public within 30 days."
Click to expand...

guest · May 8, 2020

Microsoft Investigating GitHub Account Hacking Claims
May 8, 2020
https://www.securityweek.com/microsoft-investigating-github-account-hacking-claims

A post offering some of the files for free on a hacker forum claims that the data is 54 GB compressed and 500 GB uncompressed, but software engineer Rafael Rivera, who also confirmed that the files appear to be real, said there are only roughly 63 GB of files when uncompressed.

A Microsoft spokesperson told SecurityWeek that the company is aware of the claims and has launched an investigation, but did not provide any additional information. A Microsoft employee initially responded to Under the Breach’s Twitter post, saying the leak was fake, but later removed their tweet.
However, Dustin Metzgar, a software engineer who in the past worked for Microsoft for nearly a decade, said the code is unlikely to contain such data as the tech giant puts a lot of effort into ensuring that secrets are removed from source code.

“They have check-in gates and routine scans for anything that looks like a secret. All certs and secrets are rotated as well. Nothing is foolproof but they make a real effort,” Metzgar said on Twitter.
Click to expand...

It's worth noting that Microsoft owns GitHub.

Twitter user Nirmal Guru also says the leaked source code appears to be real, but points out that it’s “useless” as all private Microsoft repositories on GitHub are made public at some point.
Click to expand...

Log in or Sign up

Hacker claims to have breached Microsoft's GitHub private repos

guest Guest

guest Guest

Log in or Sign up

Hacker claims to have breached Microsoft's GitHub private repos

guest Guest

guest Guest

Useful Searches