GitHub: Attacker breached dozens of orgs using stolen OAuth tokens

GitHub revealed today that an attacker is using stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories.

Since this campaign was first spotted on April 12, 2022, the threat actor has already accessed and stolen data from dozens of victim organizations using Heroku and Travis-CI-maintained OAuth apps, including npm.

"The applications maintained by these integrators were used by GitHub users, including GitHub itself," revealed today Mike Hanley, Chief Security Officer (CSO) at GitHub.

"We do not believe the attacker obtained these tokens via a compromise of GitHub or its systems, because the tokens in question are not stored by GitHub in their original, usable formats.

"Our analysis of other behavior by the threat actor suggests that the actors may be mining the downloaded private repository contents, to which the stolen OAuth token had access, for secrets that could be used to pivot into other infrastructure."

According to Hanley the list of impacted OAuth applications includes:

• Heroku Dashboard (ID: 145909)
• Heroku Dashboard (ID: 628778)
• Heroku Dashboard – Preview (ID: 313468)
• Heroku Dashboard – Classic (ID: 363831)
• Travis CI (ID: 9216)

GitHub Security identified the unauthorized access to GitHub's npm production infrastructure on April 12 after the attacker used a compromised AWS API key.

The attacker likely obtained the API key after downloading multiple private npm repositories using stolen OAuth tokens.

"Upon discovering the broader theft of third-party OAuth tokens not stored by GitHub or npm on the evening of April 13, we immediately took action to protect GitHub and npm by revoking tokens associated with GitHub and npm’s internal use of these compromised applications," Hanley added.

The impact on the npm organization includes unauthorized access to private GitHub.com repositories and "potential access" to npm packages on AWS S3 storage.

GitHub has uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact to GitHub, npm, and our users. https://t.co/eB7IJfJfh1

— GitHub Security (@GitHubSecurity) April 15, 2022

GitHub's private repositories not affected

While the attacker was able to steal data from the compromised repositories, GitHub believes that none of the packages were modified and no user account data or credentials were accessed in the incident.

"npm uses completely separate infrastructure from GitHub.com; GitHub was not affected in this original attack," Hanley said.

"Though investigation continues, we have found no evidence that other GitHub-owned private repos were cloned by the attacker using stolen third-party OAuth tokens."

GitHub is working on notifying all impacted users and organizations as they are identified with additional information.

You should review your organization's audit logs and the user account security logs for anomalous, potential malicious activity.

You can find more information on how GitHub responded to protect its users and what customers and organizations need to know in the security alert published on Friday.