Github account compromised

by runninggee • 13 years ago

16 15 13 years ago

olefoo2• 13 years ago

Sounds like Github is doing the right thing. Detecting your account is compromised and forcing a reset of credentials.

It does sound like they might need to up their game on traffic monitoring, since how did the attacker get enough tries to brute force even a simple password? But that's why it's an arms race.

nilved4• 13 years ago

No, it'd be the right thing if they didn't get hacked to begin with. This is _GitHub_ being bested by _brute force_.

AdamGibbins2• 13 years ago

How do you reasonably protect from brute force? Other than enforcing secure passwords.

You block IPs that make too many fail attempts - you block an entire NAT range i.e. schools. Kids like to troll each other.

Alternatives?

olefoo2• 13 years ago

Well, if all we have to go by is this email; it's rather hard to make judgments about what Github did or didn't do.

I'd hope that github will do a post-mortem, and tell us what they know of the breaches.

nilved4• 13 years ago

I got this email too, which I found to be really lacking in detail. I asked for more info and will post their response if its applicable.

There's literally no way my password was brute forced unless the adversary built a quantum computer, so I think this indicates that GitHub was attacked as opposed to the users directly.

AdamGibbins2• 13 years ago

GitHub have two factor authentication - why're you not using it?

nilved4• 13 years ago

With a secure password and secure browsing habits, I shouldn't need to. I shouldn't need to inconvenience myself like that to accomodate for the host's poor security.

jclos• 13 years ago

Honestly depending on what you use Github for, 2-factor authentication is a pretty minor inconvenience compared to the loss of the account.

andydev• 13 years ago

Worth checking https://github.com/settings/security to see if you've seen any failed login attempts that aren't you.

Also recommend enabling 2 factor authentication.

jlgaddis• 13 years ago

Indeed, I've got failed login attempts from four different IP addresses (115.127.35.4, 183.96.115.54, 186.89.119.140, and 190.73.143.216) over the last two days.

craz• 13 years ago

Similar to mine. Nothing for years, then three attempts in last couple of days. I wonder if they got my email from the Adobe breach.

runninggee• 13 years ago

190.206.118.221, 61.247.35.20, 201.243.203.209, 190.204.171.95, 190.36.181.198, 213.163.72.224 were the IPs that hit me. But yes, only for the last 3 days and there's no way they guessed my password in 5 attempts, unless someone's decrypted the Adobe document

bratsche• 13 years ago

I have 2-factor authentication enabled (in fact, it's part of my company's security policy that everyone must follow).. but I went to that page and saw shitloads of "user.failed_login" messages over the past five days and it kind of freaks me out.

That said, it kind of freaks me out in a good way. I'm glad github has this panel. People should be aware when several failed login attempts are made on their accounts.

briandoll• 13 years ago

We just posted more details on this incident: https://github.com/blog/1698-weak-passwords-brute-forced

Github account compromised

Related Stories