According to ReversingLabs researcher Karlo Zanki , cybercriminals are increasingly using GitHub for malicious purposes .
"Malware creators occasionally place their samples on services like Dropbox, Google Drive, OneDrive , and Discord to host second stage malware and evade detection," said .
However, the researcher says that recently there has been an increased use of GitHub for hosting malware.
See also: Malvertasing campaign spreads “PikaBot” malware!
Hackers often turn to legitimate services to host malware and act as dead drop resolvers to retrieve the actual command-and-control (C2) address.
Using public sources for C2 does not completely protect them from takedowns, but it allows attackers to easily create attack that are cheap and reliable.
Using legitimate services is a sneaky tactic as it allows attackers to mix malicious network traffic with genuine communications within a compromised network. As a result, the chances of an infected endpoint communicating with a GitHub repository being flagged as suspicious are less likely.
In fact, the abuse of GitHub gists shows an evolution of this new trend. Gists offer an easy way for developers to share code snippets with others.
Public gists appear in GitHub's Discover feed, while secret gists, while not accessible through Discover, can be shared with others (by sharing the URL). However, if a third party discovers the URL, they will also be able to view the gist. Another interesting aspect of secret gists is that they do not appear on the creator's GitHub profile page, allowing threat to exploit them as a kind of pastebin service.
See also: Westpole: Ransomware attack disrupts Italian Public Administration's digital services
ReversingLabs said it found several PyPI packages (httprequesthub, pyhttpproxifier, libsock, libproxy, and libsocks5) that were masquerading as libraries for handling network proxying, but contained a Base64-encoded URL pointing to a secret gist hosted on a throwaway GitHub account with no public-facing projects.
The gist features Base64-encoded commands that are parsed and executed in a new process, via malicious code present in the file of the fake packages.
In 2019, Trend Micro had also observed the distribution of malicious commands via secret gists.
Additionally, a second technique identified involves exploiting version control system features, relying on git commit messages to extract commands to execute on the system.
The PyPI package, called easyhttprequest, embeds malicious code that “clones a specific git repository from GitHub and checks if the 'head' commit of that repository contains a commit message that starts with a specific string,” Zanki said.
All malicious packages have now been removed from the Python Package Index (PyPI) repository.
See also: Microsoft: Critical RCE vulnerability in Perforce Helix Core server
“Using GitHub as a C2 infrastructure is not new, but abusing features like Git Gists and commit messages for command delivery are new approaches used by malicious actors,” Zanki concluded.
How to protect yourself from malware?
The first and most important strategy for protecting against malware is to apply updates. It is important to regularly update your operating system and security software, as updates often include fixes for vulnerabilities that hackers can exploit.
It is also important to use up -to-date antivirus software that can detect and remove the latest threats. This software must be updated regularly to remain effective.
Education of the techniques hackers use to hide malware so they can recognize and avoid attacks.
Additionally, using VPN networks and protecting your connections with encryption can help protect against the hidden installation of malware.
Finally, carefully managing access rights to your computer can provide additional protection. Avoid using accounts with administrator privileges for everyday use and limit access to sensitive files.
Source: thehackernews.com
