Security Experts Urge IT to Lock Down GitHub Services

Threat intelligence firm Recorded Future has warned that threat actors are increasingly using GitHub services to launch covert cyber-attacks, and urged IT teams to take action.

Its new report, Flying Under the Radar: Abusing GitHub for Malicious Infrastructure, revealed the most popular GitHub services for threat actors.

An analysis of threat intelligence samples between March and November 2023 showed GitHub Raw (40%), GitHub Objects (35%) and GitHub Pages (14%) were most often used in attacks.

GitHub is used by almost 100 million developers and so represents a potentially large-scale threat if the platform can be successfully abused.

Read more on GitHub threats: Millions Face RepoJacking Risk on GitHub Repositories

Recorded Future claimed that threat actors use it to blend in with benign network traffic, thus keeping malicious activity hidden. It added that GitHub services usually remain unblocked in organizations but benefit from high uptime, minimal new account vetting and limited detection possibilities for service providers.

That makes it a popular, low-cost and highly effective platform for command-and-control (C&C) infrastructure, silent delivery of malware payloads and exfiltration of data, the report claimed.

Organizations need to consider GitHub in their threat modelling, Recorded Future argued.

“In the near term, defenders should pursue a service-based strategy by flagging or even blocking specific GitHub services that are not normally used in their environment and are known to be used maliciously,” the report noted.

“This should be paired with a context-based strategy based on the principle that only specific parts of a corporate environment necessitate interaction with particular GitHub services. In the longer term, organizations should allocate resources to better understand how GitHub and other code repositories are abused.”

It concluded with eight recommendations:

• Enhance visibility into GitHub with granular monitoring of all web and cloud traffic and context-aware policies enforced at the instance level
• Maintain an up-to-date asset inventory listing all users authorized to access GitHub
• Adapt detection strategies to align with the organization’s particular environment
• Deploy adaptive security policies, potentially alongside application allow-listing
• Protect GitHub accounts to prevent hijacking by threat actors to steal code or use as C&C infrastructure
• Continually assess effectiveness of threat detection capabilities by integrating scenarios of GitHub abuse into attack simulations
• Collaborate with GitHub to help it fight back against known malicious activity on the platform
• Perform proactive threat hunting to fight unknown instances of GitHub abuse