Dozens of organizations were breached by hackers using stolen OAuth tokens, GitHub reports

GitHub announced on Friday that it had discovered evidence that an unidentified adversary had exploited stolen OAuth user tokens to unauthorized download data from multiple organizations.

GitHub’s Mike Hanley disclosed in a report that an attacker used stolen OAuth user tokens to download CSV files from dozens of organizations, including NPM.

Apps and services often use OAuth access tokens to grant access to specific parts of a user’s data and to communicate with each other without having to share login credentials.A single sign-on (SSO) service passes authorization to another application using this method.

As of April 15, 2022, the list of affected OAuth applications is as follows –

  • Heroku Dashboard (ID: 145909)
  • Heroku Dashboard (ID: 628778)
  • Heroku Dashboard – Preview (ID: 313468)
  • Heroku Dashboard – Classic (ID: 363831), and
  • Travis CI (ID: 9216)

The OAuth tokens are not said to have been obtained via a breach of GitHub or its systems, the company said, as it doesn’t store the tokens in their original, usable formats.

Additionally, GitHub warned that the threat actor may be analyzing the downloaded private repository contents from victim entities using these third-party OAuth apps to glean additional secrets that could then be leveraged to pivot to other parts of their infrastructure.

The Microsoft-owned platform noted it found early evidence of the attack campaign on April 12 when it encountered unauthorized access to its NPM production environment using a compromised AWS API key.

This AWS API key is believed to have been obtained by downloading a set of unspecified private NPM repositories using the stolen OAuth token from one of the two affected OAuth applications. GitHub said it has since revoked the access tokens associated with the affected apps.

“At this point, we assess that the attacker did not modify any packages or gain access to any user account data or credentials,” the company said, adding it’s still investigating to ascertain if the attacker viewed or downloaded private packages.

GitHub also said it’s currently working to identify and notify all of the known-affected victim users and organizations that may be impacted as a result of this incident over the next 72 hours.

Some sections of this post are sourced from:

Add a Comment

Your email address will not be published. Required fields are marked *