Red Hat confirms security incident after hackers breach GitLab instance

https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-claim-github-breach/

by speckx • 10 months ago

246 52 10 months ago

INTPenis• 10 months ago

Red Hat, I am very disappointed. We're all ISO27001 everywhere, separation of data, and separation of network resources. But you keep our data in your github repo?

ExoticPearTree2• 10 months ago

Data is separated in different repositories, per the story.

And, never forget: what a company preaches and advertises is not the same with what the company is actually doing.

zingababba• 10 months ago

Yes, I've been in fortune 100 IT security for awhile now. When it comes to passing audits its a shit ton of misdirection.

Also, here is some more information about this breach: https://x.com/intcyberdigest/status/1973422846396473765

mmh0000• 10 months ago

You've got to look at ISO27001 from the perspective of the Sales Rep, not from an Engineer.

In theory, being ISO27001 means that you're environment follows best practices and has a somewhat sane security posture.

To the business people, a new customer demands that you have ISO27001 certification before they'll sign the $$$$ contract. The salesperson does not care HOW you get the certificate, just that you have it, they need this contract signed!

The department wasn't designed with security in mind, so implementing everything required by ISO will take many months. But sales needs $$$$ now! The CEO, CFO, and CTO are aligned: money now!

So, there's high pressure to pass the audit quickly. You implement what you can, you weasle your way around the things that will take too long. Those things are "out of scope" or "testing databases". You implement MFA while the auditor is auditing, but you know it breaks developers' workflows and there isn't a quick fix, so you turn MFA back off once the audit is complete....

TA-DA! We're ISO27001 certified! But we're no more secure than we were before.

throwaway127482• 10 months ago

Engineers who are smart enough / talented enough, and who feel secure, can push back on security issues even if it will hold up a deal. This tells me that the most valuable engineers at Red Hat either do not push back enough on security concerns, or don't care enough (or aren't experienced enough) to know that the concerns exist in the first place, or they feel insecure in their position.

latchkey• 10 months ago

100%! Insert SOC2, HIPAA, etc...

Grikbdl• 10 months ago

In theory, being ISO27001 means that you're environment follows best practices and has a somewhat sane security posture.

Nah, it just means you have defined, documented processes and document that you stick to them. They actual processes can be shit and maybe you also have something on the side the auditors don't get shown, but ultimately the certification is a total joke. Source: Worked at a place that got certified despite being a security joke.

Woodi• 10 months ago

[..] The CEO, CFO, and CTO are aligned: money now!

"Aligned" :)) The IT terminology FTW! Very very realistic description. Of not delivering value to customers.

Was this a case in this RH breach ? Maybe. But just putting multiple "repos" and other client stuff in same place is modern IT insanity.

At least they could put that Navy stuff somewhere else. Resonable idea, right?

baobun2• 10 months ago

Correction: After publishing, Red Hat confirmed that it was a breach of one of its GitLab instances, and not GitHub. Title and story updated.
After publishing our story, Red Hat confirmed that the security incident was a breach of its GitLab instance used solely for Red Hat Consulting on consulting engagements, and not GitHub.
While Red Hat did not respond to any further questions about the breach, the hackers told BleepingComputer that the intrusion occurred approximately two weeks ago.

6c696e7578• 10 months ago

GitLab, not GitHub. I think the distinction is that you can have a on-prem GitLab (as well as hosted online). The implication here being that RedHat probably had very relaxed account security.

elicash2• 10 months ago

"The hackers stated that they attempted to contact Red Hat with an extortion demand but received no response other than a templated reply instructing them to submit a vulnerability report to their security team."

Just hilarious

1970-01-01• 10 months ago

You didn't give the kicker:

"According to them, the created ticket was repeatedly assigned to additional people, including Red Hat's legal and security staff members."

Summarized: Given enough eyeballs, all extortion demands are fallow.

nomilk• 10 months ago

fallow == marked by inactivity

Thanks, hadn't encountered this word before.

elicash2• 10 months ago

And then there's more, via 404:

“Since RedHat doesn't want to answer to us,” the hackers wrote in a channel on Telegram viewed by 404 Media, suggesting they have attempted to contact Red Hat. [...]

“We have given them too much time already to answer lol instead of just starting a discussion they kept ignoring the emails,” the message added. In another message, the group said it had “gained access to some of their clients' infrastructure as well, already warned them but yeah they preferred ignoring us.”

https://www.404media.co/red-hat-investigating-breach-impacti...

andmarios• 10 months ago

To be fair, once your data has been stolen, it doesn't make sense to engage with the hackers. There is no way to guarantee that the stolen data won't be used.

What you must do immediately is notify the affected customers, bring down or lock the affected services, and contact the authorities.

jayd16• 10 months ago

Corpo cyberpunk

behnamoh2• 10 months ago

Can't be extorted if you can't be reached. such a two-brain move!

lanfeust6• 10 months ago

made my day

devonkim• 10 months ago

This whole process happening is exactly what happens in a quest in Cyberpunk 2077. There’s an e-mail chain where a gang tried to extort a corporation and gave up after being unable to reach a person.

I sincerely hope that the game doesn’t become prophetic in the manner Idiocracy has.

zb3• 10 months ago

Telegram name: "thecrimsoncollective"

dang• 10 months ago

[stub for offtopicness]

(title fixed now)

stingrae• 10 months ago

Correction Posted: "After publishing, Red Hat confirmed that it was a GitLab account breach, not GitHub."

erikerikson• 10 months ago

"Correction: After publishing, Red Hat confirmed that it was a breach of one of its GitLab instances, and not GitHub. Title and story updated."

Title needs updating

sateesh• 10 months ago

It's GitLab not GitHub

hoffie• 10 months ago

There seems to be an official statement by Red Hat now: https://access.redhat.com/articles/7132207

commandersaki• 10 months ago

Oh that's surprising, it isn't behind a paywall.

QuantumNoodle• 10 months ago

Before even reading the article, the title made me lol as I thought the open sourced code was stolen XD

Red Hat confirms security incident after hackers breach GitLab instance

Related Stories