HN Explorer

Ask HN: How did my GitHub password breach and how to react?

9 points by jFriedensreich ↗ HN
I got a 2 way authentication warning from github that someone in canada successfully entered my github password and was stopped by 2 way authentication.

Normally session warnings are business as usual but in this case my password was entered and it was generated by a password manager with high entropy, was only stored in dashlane, 1password and chrome password manager.

A google search for the password had no results and have haveibeenpwned shows no known breach. I have no idea how this could have leaked and what my security status is now. I have some productivity apps on my mac with accessibility permissions to read my clipboard (yippy, zoom, teams, pgp), but i am not sure i have to assume one of these apps is compromised and wipe my whole machine.

Does anyone have any ideas about breaches not in haveibeenpwned or what a reasonable response would be or could chime in what they would do? I know in theory i would need to wipe my machine and then change all my passwords wich would take weeks, but i am not sure this is an overreaction.

9 comments

[ 3.4 ms ] story [ 31.9 ms ] thread
surprisetalk
I'm so sorry to hear you're going through this. I got hacked a few years ago through a SIM swap attack, and it feels terrible being violated like that.

This does not sound like an overreaction.

I would personally (1) wipe my machine and (2) reset all my passwords. I'd be very selective about which tools I reintroduce into my workflow.

gostsamo
You might've been fished with a fake site to provide the gh password while the attacker didn't expect that you have 2fa enabled. Alternatively, a badchrome extension, but it would've stolen much more like session cookies and the like. I'm not sure about 1password dashlane, but, and the rest.

What is your thread model? Who would like to hack you and what access would they gain? Act according to that.

jFriedensreich
Thank you! I dont think fishing is plausible, as i always manually re-enter websites if a password is required, i never use links in emails. Also i am not highly exposed i dont think a targeted attack is likely. I disabled some browser extension now, thats also a good possiblity.
gostsamo
If you don't know the vector of attack, maybe it would be good to reset everything and blow the whistle if you are in any organization which could be affected. Also, check moving to a hardware key if you are not already.

Good luck!

jFriedensreich
so i found out the attacker most probably used a compromised host from www.ovh.com as jump host.
e1g
Can you expand? Unclear what pathway there is to go from a compromised host to your password store.
jFriedensreich
unfortunately thats impossible to say this is only the path they used to try the actual login. how they got the password is not possible to say still.
jFriedensreich
sorry, i forgot to add that i have nothing to do with that hoster, its someone else's server, i contacted them to let them know that there is either a malicious customer or more likely a compromised host that is either sold individually or in a bot net.
jFriedensreich
update in case anyone stumbles across this later: the software that caused the issue has been identified and was related to one of my clients product code, no browser extension, mentioned mac utility application or phishing attack was the cause.

my takeaways:

- non sms 2FA is obligatory everywhere no exception

- password expiration after one year makes sense and can help finding breaches much faster

- applications should have an enforceable field to attach a note to a new session for finding possible breach source or remembering legitimate access that is further in the past

- passwords are stupid and should be replaced in general