How GitHub untangled itself from the ‘Octopus’ malware that infected 26 software projects

It's an example of the potentially insidious nature of open-source supply chain compromises.

For GitHub, not all reports about malicious software on its platform are of equal importance.

The company behind the popular software repository, where developers often share code rather than building it from scratch, revealed this week that attackers were trying to exploit the open-source nature of the site to distribute malware. A hacking tool was designed to spread through software projects, then leave a “backdoor” that could offer hackers persistent access to the software.

By infiltrating open-source software, hackers could have given themselves a foothold in code that was later included in corporate apps or websites. Open-source websites continue to represent valuable targets for hackers hoping that technology companies will adopt compromised tools to build their own software. (GitHub claims the site has tens of millions of users.)

In this case, the malicious code — which spread to 26 different GitHub projects — is an example of the potentially insidious nature of open-source supply chain compromises. Dubbed Octopus Scanner, the malware deployed a remote access hacking tool that can be used to gather data. It was spreading through projects that used a popular software called Apache NetBeans, the company said.

“There is a huge potential for escalation of access, which is a core attacker objective in most cases,” GitHub security researcher Alvaro Muñoz wrote in a blog post Thursday.

Leaving the code unattended wasn’t an option because of the access it could provide attackers to other projects and production environments. After being tipped off by an independent researcher, Muñoz and his team had the laborious task of pinpointing the code and removing it from the infected repositories.

Security staffers’ initial plan of contacting the owners of the repositories and telling them to clean up their digital stashes wasn’t enough to contain the malware. They had to dissect the code to see the different files it was infecting, then figure out how to halt its spread.

It is unclear who is behind Octopus Scanner, or what they were after. But it gave Muñoz a headache that he said he hopes won’t return.

“While infecting build processes is certainly not a new idea, seeing it actively deployed and used in the wild is certainly a disturbing trend,” he wrote. In another example, a version of the popular Webmin system configuration tool released last year contained a “backdoor” that someone familiar with the program could have exploited.

Federico Maggi, a senior researcher at cybersecurity company Trend Micro, said the GitHub infections were a reminder of the access that open-source software libraries can give hackers. Maggi recently showed how compromising a different software library could be used to deliver malware to devices in a factory.

“This tactic is very powerful because it gives indirect access to many systems.” Maggi said in an email Friday. “You include a malicious open source library, and anything you build with that included in the chain will run that malicious code.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure