Overview:

GitHub's collaborative environment can provide a host of unique benefits, but there are potential risks and vulnerabilities. This article helps identify how to avoid risks like unauthorized access and data exposure. Continue reading for recommendations how to implement strict access controls, enforce code reviews, and leverage automated security tools. 
 

What is GitHub?

GitHub is a Microsoft platform for open source code hosting and collaboration, but it carries risks. These were highlighted when the Stargazers Ghost Network used the platform to distribute malware. Threat actors, known as Stargazer Goblin, used over 3,000 fake GitHub accounts to infect members' systems. The following information is meant to help you avoid these risks while utilizing this resource.
 

Risks Associated with Enabling GitHub:

1. Malware Distribution: Malicious actors can use GitHub repositories to distribute malware. As noted above, the Stargazers Ghost Network incident used 3,000 fake accounts to push infostealer malware, including:
   • RedLine
   • Lumma Stealer
   • Rhadamanthys
   • RisePro
   • Atlantida Stealer

Consequence: Potential compromise of organizational systems, leading to data breaches and financial loss.

2. Phishing Attacks: Attackers can create phishing templates that look legitimate, using GitHub's trusted reputation to lure victims into downloading malicious files.
   Consequence: Unauthorized access to sensitive information and credentials.
    
3. Credential Leakage: Developers might inadvertently commit sensitive information, such as API keys and passwords, to public repositories.
   Consequence: Exposure of confidential information leading to unauthorized access.
    
4. Repository Hijacking: Unauthorized individuals can gain control over repositories, potentially altering or deleting critical code.
   Consequence: Disruption of development activities and potential introduction of malicious code.
    

Best Practices for Protecting Your Data on GitHub:

1. Enable Multi-Factor Authentication (MFA)
   Multi-factor authentication adds an extra layer of security to your GitHub account. Activate MFA in your GitHub account settings and use an authentication app like Google Authenticator for added security.
    
2. Keep Your Repositories Private (When needed)
   If you're working on projects that include sensitive information. Always double-check your repository settings, especially if you're working on school projects or anything containing personal data.
    
3. Be Cautious About Committing Sensitive Information
   Accidentally committing passwords, API keys, or other sensitive data can lead to serious security issues. Once it's out there, there's no UNDO.
    
4. Regularly Review and Update Dependencies
   Many student projects rely on third-party libraries and dependencies. If these are outdated, they can introduce vulnerabilities to your project. Use tools like DePenda Bot to automatically keep your dependencies up-to-date and free from known vulnerabilities.
    
5. Limit Access and Collaborate Wisely
   When collaborating on projects, only give access to trusted classmates or team members. Avoid giving write access unless necessary. Use GitHub’s role-based access control to manage.
    

Other Recommendations:

1. Regular Security Audits: Conduct periodic security audits of GitHub repositories and access controls.
2. Confirm Security Settings: Review and implement the GitHub-recommended security configurations.
3. User Awareness and Training: Users should exercise extreme caution when arriving at GitHub repositories via advertising, Google Search results, YouTube videos, Telegram, or social media. Be vigilant with file downloads and scrutinize URLs before clicking on them. Participate in ongoing security training to recognize and respond to phishing attempts and other threats.
4. Use of VM and Security Tools: Extract git archives on a VM and scan the extracted contents with antivirus software to check for malware or use scanning tools to scan the contents.
5. Incident Response Plan: Develop and maintain an incident response plan specific to GitHub-related threats.