Canonical Ltd., the companybehind the Ubuntu Linux, announced that its GitHub account was compromised by hackers on Saturday.
Specifically, the company stated that on Saturday, 06/07/2019, a Canonical account on GitHub was hacked, after the credentials were compromised by hackers
He continued by saying: “Canonical has removed the compromised account from GitHub and is still investigating the extent of the breach, but there is no indication at this point that any source code or PII has been affected.
“Furthermore, the Launchpad infrastructure, on which the Ubuntu, is not connected to GitHub and there is no indication that it has been affected.”
Canonical's security team said it would provide more details once it completes its investigation into the breach incident.
According to reports, the hacker compromised the GitHub account and created 11 new GitHub repositories on Canonical's official account. The repositories were empty.
On Thursday, before the incident, security firm Bad Packets discovered that hackers were scanning the internet for configuration files. These files can contain credentials for Git accounts, such as those used to manage code on GitHub.com.
It is not the first time that Canonical falls victim to an attack.
The official Ubuntu forums have been hacked three times in the past. The first breach occurred in July 2013, where hackers managed to steal the data of 1.82 million users. The second incident took place in July 2016, where data of 2 million users was stolen, and the third incident occurred in December 2016.
More recently, in May 2018, a malicious Ubuntu package was found, which contained a cryptominer and was present in the official Ubuntu store.
However, these Canonical security incidents are nothing compared to what happened with Linux Mint in February 2016. In that case, hackers compromised the site and infected the operating system's source code, installing a backdoor. Something similar happened to the Gentoo Linux distribution in June 2018, when hackers gained access to the GitHub repos and infected some GitHub downloads with a version of the operating system that contained a backdoor.
So far, there is not much information about the breach that took place on Saturday. However, the incident does not seem that serious. If the hacker had added malicious code to Canonical's projects, it would not have drawn attention by creating new repositories in the company's GitHub account.
