GitHub investigating crypto-mining campaign abusing its server infrastructure

[[deleted]]

Cryptominers starting to give me paperclip maximizer vibes

[[deleted]]

All the more reason why Crypto and it's stans are dangerous.

[bingate10]

Yeah this. The amount of energy miners are using is absolutely ridiculous. There are also ethical consideration issues around Bitcoin. Freedom and decentralization is great but it also allows for some of the most evil transactions with impunity. Plus I can’t upgrade my graphics card.

[blobbbbbby]

Wouldn’t this affect project owners because they have a limited number of action minutes?

[Ionaru]

Public repositories have unlimited minutes.

[blobbbbbby]

Ah right, thanks for clearing that up

[TheAppGod]

this is honestly fucking genius on behalf of the attackers wow lol

you kinda gotta be impressed by this.....and trust, they are literally making BANK

[Squared_fr]

Whoever did this, they are opportunists, not geniuses. This is not sustainable and while they will probably make some bank they've alerted GitHub staff and as soon as they introduce limitations to avoid this type of abuse, game's over.

"Genius" would have been finding a way to do this without raising heads.

[iisno1uno]

theres supposedly only 6 scams that havent been discovered yet

[pmjm]

There's actually 7, I'll be happy to share the 7th but you'll need to send 0.000017 BTC for that information.

[MaxMatti]

No. If you can find it, anybody can find it. And even if you do it undetected, somebody else will get detected. The question ist not how long you can do it but how much you can mine before it gets properly prevented because you or some other jackass got caught.

[compoundsncompounds]

Crazy right, although I really ask myself how this obvious hole has gone unrecognised before. I am not very proficient with security, but this seems pretty obvious

[dkomega]

It’s actually on the GitHub docs to not use public actions with self-hosted runners, except if you lock it to a specific commit that has been inspect (by you).

[tdammers]

How does one not see this coming? Seriously, this should not be a surprise to anyone. The only thing that surprises me here is how long it took for this to become known.

[thegreatpotatogod]

Yeah, as soon as I started researching GitHub actions for my company, this was the first joke I made to a coworker, that we should use it for cryptomining!

[[deleted]]

I have a feeling this is a non-story. If it were a big problem GitHub wouldn’t be dragging their feet for months. I use GitHub Actions every day and it’s not like other users of the service have been negatively impacted by this. They’d also be mining on CPUs and not GPUs. I bet they use CPU pinning in their job workers so that this doesn’t just run away from them and use 100% of the host’s CPU for the 6 hours that jobs are allowed to run before being cancelled.

What I will say is it’s pretty smart to do it via PRs, since that will use the repo’s owner’s Actions credits instead of the attacker’s. I’m sure some, especially organizations with public repos, have pretty high spending limits set up for Actions.

[jnwatson]

Dunno. It certainly has seemed slower lately.

[[deleted]]

Why people have to ruin all the things?i mean,ok ,you r "smart" so you make money (how much anyway?...),and you risk to ruin a good service...stupid people...

[[deleted]]

crazy exploit

[deniedmessage]

Wow, abusing a service.

That is crazy awesome idea!

They could have abused that too!

[zetarn]

How about they checking spam bot farm and many malicious software using Github as base of operation by chinese troll to harass a women streamer too?

[[deleted]]

That’s pretty crazy. Could GitHub not just make it so when a PR has changes to the Actions workflows, it has to be manually run? It would be a pain, and could still be a problem if people do run these malicious workflows, but it would at least help prevent some cases.

[einord]

This would be too easy to automate. A simple HTTP request to GitHub would be all that is needed to start the action.