Hackers "paid" for mining on the GitHub server, converting about 30,000 mining tasks in three days

原文标题：《 黑客用 GitHub 服务器挖矿，三天跑了 3 万个任务，代码惊现中文 》

原文来源： 量子位

With the price of cryptocurrency soaring and graphics cards unaffordable, how can you mine on the cheap?

Hackers moved a crooked idea - "white piao" server.

Having a Trojan horse for mining on a PC is no longer enough to keep up with hackers' growing demand for computing power, and it would be nice to be able to use GitHub's servers at no cost.

And the whole process could be easier than hacking into a PC, without even requiring a programmer to be duped. Just submit a Pull Request (PR) and the malicious mining code can still be executed even if the project manager doesn't approve it.

The principle is simple. Using GitHub Action's automated workflow feature, it's easy to run a mining application on a GitHub server.

Hacking was discovered as early as last November. What is more terrible is that half a year has passed and this phenomenon has not been effectively stopped.

GitHub is upset that although it can block accounts that break the rules, hackers play guerrilla tactics and keep the authorities on the run by constantly changing their passwords to avoid being caught.

Just a few days ago, a programmer in the Netherlands discovered that the attack was still going on, even with Chinese characters in the code.

So how did these hackers get into the mining program? It all started with Tib, the French programmer who discovered the anomaly.

PR exceptions make programmers suspicious

Last November, Tib found itself receiving a PR request from a repo that did not participate. Within 14 hours, seven had arrived, all from a single "y4ndexhater1" user with no description.

Surprisingly, this is not a hot project, with zero STAR.

When you open the project home page, you find a collection of GitHub actions, Circle CI, travis-CI sample code for your Perl project, and the entire README documentation is a mess that doesn't look like a serious open source project.

However, this chaotic and unpopular repo has been forked twice in three days.

Everything was so out of whack that there was a whiff of uneasiness.

Try "death" running

In the spirit of "death," Tib decided to find out.

After the actions of the suspect user, all actions of TIB are deleted and a ci.yml file is added to the workflow, which reads as follows:

当 Tib 看到 eval  "$(echo "XB0IHVwZGF0ZSAt 这一行内容后，立刻从沙发上跳了起来，他意识到事情的严重性：有人在入侵他的 GitHub 个人资料！

This seemingly mysterious string of characters is actually base64 encoded. After translation, we get another piece of code:

I don't need to explain the first two lines, but the interesting part starts with the third line, which downloads a prog binary.

To be on the safe side, the TIB tries to get the information first, rather than executing it, and gets its hexadecimal code.

  $objdump-s -- section.comment prog

prog: file format elf64-x86-64

Contents of section .comment:

0000 4743433a 2028416c 70696e65 2031302e GCC: (Alpine 10.

0010 322E315F 70726531 29203130 2E322E31 2.1_PRE1) 10.2.1

0020 20323032 30313230 3300 20201203.

The TIB also considered decompilation, but without success.

Nothing ventured, nothing gained, TIB decided to give it a try.

To perform this daring and desperate task to prevent "try and die," Tib first disconnected his computer from the Internet and chose to run it in a Docker container. The answer turned out to be a mining program called XMRIG.

$. / prog - version

XMRig 6.8.1

Built on FEB 3 2021 with GCC 10.2.1

features: 64-bit AES

Libuv / 1.40.0

OpenSSL / 1.1.1 I

Hwloc / 2.4.0

At that time, the latest version of XMRIG happened to be 6.8.1, which matched the above version parameters. However, after testing the PROG with SHA256, it turns out that the PROG is not exactly XMRIG, and TIB predicts that it may be a modified version.

In fact, it's not just GitHub that could be targeted. Security firm Aqua speculates that SaaS software development environments like Docker Hub, Travis CI, and Circle CI could be vulnerable to such attacks.

During this attack, a legitimate repo is derived that is responsible for adding the malicious GitHub Action to the original code. The hacker then submits a PR to the original repo, merging the code back into the original repo.

The downloaded mining program, disguised as a PROG or GCC compiler, performs an automated workflow on the project by submitting a PR. At this point the server will run the disguised mining program.

These attackers can run up to 100 mining programs in a single attack, which puts a huge amount of computation on GitHub's servers.

Aqua estimates that mining hackers made over 23,300 commits on GitHub, 58,000 builds on Docker Hub, and converted about 30,000 mining tasks in just three days.

It can be prevented but hard to eradicate

This attack does not even require the targeted warehouse manager to accept a malicious Pull Request.

As long as any.yml file in the.github/workflows directory is configured to execute when a Pull Request is received, the Action from the hacker is automatically executed.

If you're not using this feature, don't worry, and the hacker probably won't find you.

If you want to use this feature, you can set it to allow only local Actions or only GitHub official and author-specific Actions.

After reporting the situation to the customer service, GitHub will block the account of the malicious account and close the relevant Pull Request.

But malicious attacks are difficult to eradicate, hackers just need to register a new account can continue to whoring server resources.

The attacks continue

We discovered from a recent attack that the hacker uploaded the mining program to GitLab and disguised it as the package management tool NPM.

Open this suspicious nani.bat and you can see:

NPM. Exe - algorithm argon2id_chukwa2

-- the pool turtlecoin.herominers.com: 10380

- wallet TRTLv3ZvhUDDzXp9RGSVKXcMvrPyV5yCpHxkDN2JRErv43xyNe5bHBaFHUogYVc58H1Td7vodta2fa43Au59Bp9qMNVrfaNwjWP

- the password xo

This time, the hacker dug a TurtleCoin *(Turtlecoin)*, which can be calculated using the CPU. At current prices, more than 4,000 coins would be worth $1.

The free server at GitHub Actions can offer two cores of the Intel E5 2673v4 with 7GB of RAM.

Roughly a few cents a day per machine, and hackers' mining programs typically run for only a few hours before they are detected. Docker Hub, for example, limits the running time of automatic builds to two hours.

However, even small mosquitoes are meat. Hackers can perform more mining procedures by finding more repositories that accept open actions and repeatedly opening and closing Pull requests.

At least 95 GitHub repositories were attacked by the same hacker account

As Twitter user Dave Walker pointed out, if you're giving away computing resources for free, expect to be attacked and abused. This is inevitable when mining is profitable.

According to the report, not only GitHub, but also continuous integration platforms such as Docker Hub, Travis CI and Circle CI, which offer similar services.

The only good news is that the hackers appear to be targeting the server resources provided by GitHub, not your code.

But that's not the only bug in GitHub Action. There are also ways for hackers to read and write developers' repositories, and even access encrypted secret files.

The Google Project Zero team notified GitHub of the bug last July. But after the 90-day repair period + 14 days of extension, GitHub still failed to solve the problem effectively.

Our advice to this is, don't trust Action writers on GitHub Marketplace, and don't hand over your keys.

Reference link:

[1]https://therecord.media/github-investigating-crypto-mining-campaign-abusing-its-server-infrastructure/

[2]https://dev.to/thibaultduponchelle/the-github-action-mining-attack-through-pull-request-2lmc

[3]https://blog.aquasec.com/container-security-alert-campaign-abusing-github-dockerhub-travis-ci-circle-ci

[4]https://twitter.com/JustinPerdok

[5]https://bugs.chromium.org/p/project-zero/issues/detail?id=2070

The original link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia