Jenn Gile 0:00

Okay, hello. It is Thursday, October 15th. I got to do something a little different with the intro today. I was listening to another podcast and I was like, wow, we really do cold open this thing. Like, we don't introduce ourselves, we don't say what we're going to talk about. So let's go crazy here. I'm Jen Guile. Uh, I have Paul McCarty with me. We're the co-founders of Open Source Malware. This is episode 25 of the Open Source Malware Show, where we take apart the week's malware news specific, usually to software supply chain malware. And we have a really um great diverse range of things to talk about today. So just to kind of summarize, GitHub has made several announcements that we're gonna go over. There's been a lot of action with the ghost action campaign, and we're gonna uh touch briefly on some things going on with um the North Korean IT worker scam. But before we get into that, I am in lovely Washington, D.C. this week for the Sands Defer uh summit. Really enjoying that so far. I'm gonna be speaking tomorrow. Paul, how's your week shake for you have?

Paul McCarty 1:14

Yeah, it's um it's shaping up and shaking up to be uh to be entertaining. Um, like I said last time, I'm enjoying being here um and you know, just kind of chilling. You and I have both been traveling a lot this year. So I'm really looking forward to RuCon in November. I'm super excited. I just saw the agenda yesterday. Oh my god, it's sick. This is like a TLP Red um conference that Google puts on down in Sydney. And I um they picked up one of my talks this year. Um, so these are gonna be tight talks, 25 minutes. Oh my gosh, I hate doing 25 minute talks.

SPEAKER_00 1:51

I know that's what I'm doing at Sands tomorrow, and it's like oops, it's good, drink some coffee and let her rip.

Paul McCarty 1:57

Right? Exactly. No intro, just it's like re our our intro for this. Right into it, baby.

Jenn Gile 2:05

All right, so uh lots of GitHub security-related things. Uh, the first one that I want to talk about is they announced push attribution for commits, which if you've been following anything Paul and I have been talking about, uh, you might understand why this is really important. Um it is trivial to fake Git history um when you're uh committing to GitHub. And so uh what GitHub is doing, asterisk, asterisk, private preview or public preview, you know, GitHub enterprise only, like it's not everyone who gets this right now. Um, but what they're doing is when uh in the UI, and I assume in the uh CLI as well, but I've only looked at it in the UI, there will be a second name if the um if there's a disparity between who the original commit was from and like the account that pushed it. So I looked at a sample the other day, and basically like what you would see is the original commit and a date stamp. And then if who pushed it, the identity that pushed it is different, you'll see a separate identity and date, or if it's the same, then the identities and dates will match on both. And so this is useful in two scenarios. Definitely the Pollenwriter one that we've been talking a lot about, where you find suspicious changes in your code, you can't figure out where it comes from, you went and looked at your commits. At this point, if you had this feature turned on, you would be able to see, oh, this is weird, even though this commit went through on this date. I'm seeing somebody push something on a subsequent date. So that would be like a nice red flag in the UI. The other scenario would be if um somebody has gotten access to your credentials and you know has gotten uh I don't know that it's a full account takeover kind of thing, but it if they push something, you would be able to see. And with some of the um permissions around this, depending on what you have in place, you can make it so that like emails have to match, things like that. You could set up rules. So I'll stop there. I said a lot. Paul, you've had a little bit of time to think about this one. Um, like taking aside who it's available for, which we should definitely talk about. Uh, thoughts about the feature.

Paul McCarty 4:42

Well, I certainly support it, and I said um to you and to a group of my single chat members that um, you know, I think it's probably one of the best changes that GitHub has introduced. That having been said, I'm still trying to work out. I was just looking at some historical um tasks jacker style, um, you know, early pawn rider stuff. And it's it's hard for me to tell what where the change has been made. Um now the other thing I want to talk about is that the this whole commit and push and github, and we all the whole industry kind of conflates it because you know the the commits happen on the the developer's machine. Now, here's the thing is that imagine a scenario where you have 10 developers that are working off of a Git directory in a local you know server, and they're all checking in code. And so there's lots of commits from me and Jen and you know eight other people. One of those members then goes to push that up to GitHub, and you now have a whole bunch of commits from different people, all kind of wrapped up into one push up to GitHub. You know, I'm kind of curious. I mean, and that's by design, right? The problem, the reason to your point earlier about how it's materially easy to fake Git wasn't built with authentication or authorization built into it, it accepts the email address that you give it, um, and that's how it kind of tracks the persona. And and so I'm just kind of curious to see how now, admittedly, not many people use that that style of development I just said a minute ago, but it absolutely is a legitimate way to write code, and so I'm just kind of curious how GitHub is then gonna represent those commits. If Paul pushes something that has mine and 10 other people's commits in it, how does that get represented, right?

Jenn Gile 6:30

Yeah, I guess we'll have to see some screenshots at some point from somebody who's doing it.

Paul McCarty 6:36

Um well, I'm gonna I'm gonna test over the weekend.

Jenn Gile 6:39

You're gonna noodle around with it. Fun.

Paul McCarty 6:41

I have to see it.

Jenn Gile 6:42

Yeah. So the other side of this is who it's accessible to. Um, it's not a huge surprise that this is limited to GitHub enterprise customers during a public preview. That's their equivalent of beta. So I'm not going to assume that they're not going to make it available to uh people who don't have access to that account level, but it's possible. And so let's follow the trail of thought there. If they don't make it available to free users, um, you know, a lot of open source maintainers and freelancers don't have access to GitHub Enterprise. Um they are the ones who tend to get targeted by a lot of these attacks. So not only are they potentially uh more likely to be a target, but also maybe less likely to be able to have the resources to do something about it. And then it's possible that some of the rules that are um available with this feature may not work for public repos um because the rule is linked to push rule sets, which the docs say are only available for private and internal repos. So it's kind of a like, will it work for the use cases that we're seeing this be a big problem? We don't know.

Paul McCarty 8:02

Yeah, I mean, God, there's just like there's just so much we could spend two episodes just talking about this feature alone or this set of features, the not you know, branch protections and push protections. But you're right, um, push protections have been around since 2024. Um, and they um have always only supported internal and private repos. And I found some um GitHub issues where people were asking some of the the project owners at GitHub why does this only support um private repos? And their response was, well, because it involves forking. And so we then then that means it's like everything in GitHub. So you have two things kind of going on. You have the fact that GitHub was written in a time before security. I've said this before, right? And it's just kind of clunky and all these things, you know, forks is a great example of this, but also too, let's just be very honest. Microsoft is not doing they're choosing to put a lot of these kind of security components in enterprise only um accounts, you know, which we have one, but like most people don't. Most people aren't paying you know that much for GitHub, if anything. So, you know, it doesn't apply to a pro account, only applies to an enterprise account. So um, because forking is involved in a public, you know, you can fork somebody else's, and if if the originating origin repo had push protections on it, then that would then filter down into it would inherit it.

Jenn Gile 9:31

Okay.

Paul McCarty 9:32

Yeah. So and here's the thing is behind the scenes, forking looks, and then they will never talk about this, but forking behind the scenes in 2026 looks different than forking does did in 2024. And so the decisions that Microsoft slash GitHub made in 2024 about the kind of knock-on effects of that, that's actually different because there are some material differences in the way forks work behind the scenes. All that having been said, um, you know, this is not gonna be a benefit to Pollenwriter, to us identifying Pollenwriter, because you know, the vast majority of people aren't gonna be able to um use it or experience it, which is really disappointing.

Jenn Gile 10:10

Yeah, my hope is that they decide to open it up to a brighter, broader audience. And I feel possibly justified in that hope because of the second feature we're gonna talk about, which is GitHub released uh GitHub Actions workflow lock files. And the second I saw that, I thought, whoa, that was fast. Like we were just dealing with ghost actions last week. This is great. And then I dug into it. I was like, oh, actually, it wouldn't help with ghost actions. Um, but it is available, it looks like, to most users. So happy to see that. So just in brief, um this is helping with a gap that attackers have used repeatedly. Um, TJ Actions is a really early example of this where people started to realize that GitHub actions could be uh potentially dangerous. Trivi um is another good example of this. But basically with workflows, they usually reference a tag, uh, an action by a tag. And uh a tag is just a label that's pointing to a specific version of a code and what the attackers have done with some of these attacks, if they've just changed where it points. What the lock file does immutable? Yeah, exactly. What the lock file has done is um, regardless of how the tag might get changed, it'll still point at the thing that you chose to point it at. So um assuming people adopt them, and I think this is a really good thing to adopt, uh, it should be relatively effective for like the trivi style attack. You know, if you're using a version of trivi that is safe, uh, they can't force you onto another version.

Paul McCarty 11:53

Yeah, I know that I don't really have any opinions on this because I I um because of what I'm about to say in a second, but before I get there, I just I want to say that a number of our friends, like Francois Boost, like is is a big fan of this. And so if he feels like this is gonna be beneficial, then I then I trust his opinion. Um, now that having been said, it turns out you gotta do some stuff to get this to work. You actually have to install some stuff, right? So you actually have to use the GitHub CLI to install something to make this work, which I just think is the kookiest freaking thing in the world that you gotta do that.

Jenn Gile 12:29

I did notice that the announcement blog for this one was what way more detailed than we tend to see. It gave me a like, okay, well, that's nice that it's detailed, but this looks a little complicated.

Paul McCarty 12:40

It's more than 250 characters.

Jenn Gile 12:42

Yeah.

Paul McCarty 12:44

Indeed, it was. I noticed that too.

Jenn Gile 12:47

Yeah. Uh, and then there's one more announcement that uh I don't think there's much to say at this stage because I would treat it as a pre-announcement. Uh, but we have seen on the GitHub Universe uh upcoming uh agenda, which I think is two weeks from now, if I'm not mistaken, um, that GitHub is going to be announcing a um a package firewall. So that is uh TBD, you know, usually they stream these things. We'll be able to watch the video after the session, we'll see what they have to say about it. Um, I don't think I have a lot more to say on that right now, but uh we should keep our eyes on it.

Paul McCarty 13:31

Yeah, the devil's in the details, right, with everything. Um, this has been a recurring theme. Um I think that they're targeting the use case here specifically is you know GitHub actions. Um and so being able to block these things via the firewall, which by the way, they have said is gonna be free, so that's cool. Um but you know, as I post on LinkedIn, I just don't, you know, I I question the veracity and you know how effective this is gonna be. You know, I I make fun of it all every week, but the reality is that you know they're saying they're doing NPM package scanning, and I I've seen zero evidence of it, except one guy talking about how it blocked something malicious in his. I personally have not seen any examples of this myself, and I'm inside the the the npm malware you know ecosystem every day. So uh to be to be to try to do it.

Jenn Gile 14:19

TBD. Yeah. Okay. Our longer topic today is ghost action. So this is a GitHub action related campaign um that our friends over at uh Git Guardian discovered, what, a year ago, something like that, 2025?

Paul McCarty 14:37

Yeah, almost a year ago. Yeah, good point.

Jenn Gile 14:40

Yeah. Um, so it is considered a software supply chain attack, but what it's doing is it's um it's a malicious GitHub Actions workflow. And what it does is it sweeps a repo's full Git history for credentials. Surprise. And of course, that's why Git Guardian would have been interested in it. Uh, exfiltrates it. Um there's some issues around like things like domain blocking doesn't work for it. It spreads in a similar way to Pollenwriter. So um once it's in a repository, if you uh, you know, consume that repository, you can catch it as well. Uh so what you saw, let's let's go in order here before we get to the second discovery that you made over the weekend. Let's talk about the first one. Um, you found it uh exfratrating to a typosquatted domain, right? And some new IP addresses.

Paul McCarty 15:36

Yeah, the um the this threat actor, who by the way I'm very intrigued, but anyhow, um uh has been using a relatively small number of IP and domain assets um until re until just the last couple weeks, and then they've spun up more. But so it's relatively easy to to see them um you know make these most recent changes, but um the um the they were dropping these security audit YAML files into the workflow, and that's how the Pollenwriter nature of this ex. And there's actually three versions of that file, all with slightly different names that are that but then you saw the threat actor writing new, you know, updating it in in near real time. Um so it's been a very, very flowy thing. And then they registered, then when they changed the IP address to this 199 address IP address, you know, about a month ago or whatever it was, they then um registered a new domain, my-github.com. And oh boy, the fun just behammed.

Jenn Gile 16:43

Yeah. Well, so part two of that, uh, we got a message from one of our community members, right? Loganathon reached out to you and um let us know. And I'm uh you can tell more of the story, I suppose. But essentially, um, this campaign has started phishing open source maintainers, sending very convincing looking emails um saying, oh no, there's a new sign-in from Moscow, Russia. Click now, secure your account, and it's uh going to that mygithub.com URL.

Paul McCarty 17:19

Yeah, and then it's just running the kind of typical proxy in the middle where you know it basically takes the username and password that you put in and sends it over to GitHub and logs you in successfully, and then in the in the meantime, you know, steals your credentials. I mean, this is older than God, right? Um, but it I actually tested it with um some of the MFA mechanisms that GitHub supports, and it actually very successfully um dealt with those MFA requirements. I was very impressed. And so this is I I'm setting in the blog post. Frankly, this is probably the best uh GitHub phishing kit that I've seen so far. But just to stop and kind of zoom back out, we're talking about the same threat actor is now doing GitHub actions-based, worm-like, not a worm, but like a worm, right? Behaviors, like some of the things. I don't know. Yeah, right. Uh anyhow. Um they're doing that, and then they're also doing phishing, right? And it's all going back to the same IP address. And then it got even more interesting.

Jenn Gile 18:24

Yeah. Well, the even more interesting is gonna be the teaser that we leave you with. Um, I was hurriedly trying to research it and ran out of time before today's uh taping. But I the the tease that I will give is another one of our community members, while doing a routine hunt, found something really interesting. And I hope to have a blog published about it later tonight, and we'll talk about it next week. Um but I think you and I um have a lot of interest in attribution on this, and I think you and I, we haven't gotten a like much of an opportunity to talk about it, but I think we agree at this stage, there's nothing pointing like a solid, we think we know who we did this, or have you have you uncovered something that I haven't gotten the download on yet?

Paul McCarty 19:16

There's been some updates, which I'll we'll talk about offline. Yeah, I gotta, it's gonna be a pain in the butt, but yeah, so there's there's updates. So more to come. More to come, and just really quickly as an addendum, if you check the IP addresses that are involved, there's only been two. These have been doing mass scanning for you know like a year. So the whole when Git Guardian identified um the ghost actions um uh attack in 2025, that IP address was busily scanning, you know, gray noise and everybody else has a ton of data about this, right? Um, and it continues to do so. So not only are they doing phishing and software supply chain attack, but they're doing mass outbound recon, you know, ostensibly looking. Poked.

Jenn Gile 20:01

We know somebody who got poked. So yeah.

Paul McCarty 20:04

Well, and yeah, and we know somebody else that also got fished too, as well, right? So, like now it's not just Logandron, is we we have multiple people inside of our network, and so that makes us think if we already have you know two or more people inside of our network that have seen this, you know, what's the actual you know, real nature of this out in the wild, and it's got to be pretty big. Um, I think this this is such an interesting case to me. Um, I'm going deep on it, so I'm excited.

Jenn Gile 20:31

Yeah, and I guess the thing that I'll leave with is I have not seen a lot of chatter about this on the interwebs, like other than Socket and Step publishing some research last week and us publishing ours. It's quiet. And you know, I this is pure speculation, but is it because it's GitHub actions and fewer people understand it and understand the risk? That's my thought. Um, but yeah, it's it's surprising to me that this is not a bigger deal right now, right?

Paul McCarty 21:03

You know, to that point, exactly I had the exact same thought, Jen. I thought, well, maybe because this is CI based, you know, this is this is where people get lost, right? But then they did the phishing thing, and I thought, oh, like all the sec ops and you know, in you know, uh InfoSec people will be interested. And like it's one of my least popular posts, you know, like in the last year. You know, it's for whatever reason ghost actions is not getting any play, um, which is unfortunate. It doesn't mean that the threat is any smaller than anything else, quite the opposite, actually. But yeah, you know, you and I can't get it.

Jenn Gile 21:37

That's all I got right now.

Paul McCarty 21:38

Yeah, exactly. There's a lot more to come with this one, so for sure.

Jenn Gile 21:42

Okay, last topic. Um, what is you flagged this for me? I'd already seen it. Uh the US Department of Justice uh published a press release, what, two days ago, um, about the North Korean IT worker scheme, saying that they have. Have worked, um, and I know I saw other posts, so I think like Cloudflare and others were involved on a takedown of um laptop farms. So it says uh there were uh law enforcement actions in Ohio and Texas resulting in charges, arrests, seizures of approximately 187 computers. Um I appreciate that the code name for this was Operation Lone Star Roundup. I I would like some name, I'd like to code name an option.

Paul McCarty 22:30

Oh speaking of which, look what I wore.

Jenn Gile 22:32

Oh, is that your last con?

Paul McCarty 22:34

That's my last con. That's the the um upside down uh shirt. I wore it because we talked about it last week.

Jenn Gile 22:41

Yep. Uh yeah, I don't know if there's a whole lot to say on this other than it's nice to see progress. Um, that clearly this is not just something the security community is talking about. Um I think continuing to swat down laptop farms has got to be a hard job. Um they can spin up more in other places, it doesn't have to be in the US, they can find friendlier jurisdictions, or if not friendly, then uh places where it's harder for law enforcement to do something about this behavior.

Paul McCarty 23:20

I think my biggest takeaway from this, having had to do a lot of disclosure to law enforcement over the years, is like please make it easier for people to like to disclose this stuff to you. And this is the case in Australia too. It's even worse here. Like, like, please, you know, you're spending all this time making these big announcements, make it easy for us to let you know when we find this stuff, right? It's super frustrating that it's as difficult as it is. Um, yeah, I mean.

Jenn Gile 23:47

Yeah, and I guess I should say, I don't think I actually said what the malicious activity was that these laptop farms are behind. So in case you've missed it, um the scam is uh North Korean operatives uh apply for just about every remote job that's out there. It's not tech jobs only. I've seen data on this, only about half of them are tech jobs. And um, if they manage to get hired, then they use these laptop farms to appear like they're you know in the place that they say they are. So there's lots of proxying going on, it's obfuscating their locations, and so they pay people um the To Catch a Thief podcast did a really, really nice interview of a young woman who had unknowingly, supposedly, um hosted a laptop farm.

Paul McCarty 24:41

And in Michigan, yeah.

Jenn Gile 24:43

I mean, they're they're good at finding desperate people. Uh, in the case of this one, they had found her, I think, through Reddit, like people looking for side jobs. Um, so this is it's a symptom of where we are economically that people need this kind of money and are willing to look the other way for something a little sketchy so they can have some guaranteed income.

Paul McCarty 25:07

Yeah, that's and just to kind of double click on that, like if you if if a North Korean operative gets a job with, let's say Facebook, Facebook is gonna send them this package, right? That includes a laptop and swag and stuff like that. And if they send it to China, well, guess what? That's a big that's a big red flag.

SPEAKER_00 25:24

That's a tell.

Paul McCarty 25:25

So they that's a tell. Send it to Kansas. So they s yeah, they send it to some you know nice residential location in Kansas or Oklahoma or Arkansas or wherever the case may be, Michigan. Um, and these people are paid by DPRK. Uh, and by the way, there's other threat actors that do this too as well. The Russians, for example, are have been known to do this. Um so yeah, I I think just kind of on that you have you bring up a great point. I always jump ahead and talk about the the technical part of it, but yeah, you know, they need a base of operations that's in the US. If they see inbound connections from like astral VPN IP addresses, then that's another red flag, right? So if instead they see something coming in from an ATT in Indiana, well, that looks like what they expect to see, right?

SPEAKER_00 26:06

Yep.

Jenn Gile 26:08

And uh there's cases that we've heard more recently of people, I guess, kind of uh playing along with these scam interviews to see how much they can get out of them. So this is, I mean, I think the good news here is North Korea's place in cybersecurity, like there's a light being shown on it that it's not able to hide um what's going on. But you know, we still don't see a lot of awareness in other areas.

Paul McCarty 26:40

So yeah, it is what it's agreed. Agreed.

Jenn Gile 26:44

Okay, well, that's I think all we have for today. Did you have anything you want to yellow before we wrap up?

Paul McCarty 26:50

I always do, but no, let's keep it let's keep it tight uh this week and um and we'll we'll ramble on next week.

Jenn Gile 26:57

Cool. Well, uh hope everybody out there in internet land is doing great, and uh we'll see you next week.

Paul McCarty 27:04

Thanks for listening. And Jen, be safe in your travel, Joe.