Ghrc.io appears to be malicious (bmitch.net)

Took the article pointing out that the c and r were transposed for me to even notice there was a problem!

Fairly compelling attack vector because it took several readings for me to even see the problem with the domain.

Damn, this can pick a typo from a CI job and do mean things.

There are alot of open source projects using this domain https://github.com/search?q=ghrc.io&type=code

Is the danger here token replay? It's using Bearer tokens, so it's not sending a password over:

<https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Aut...>

Threats section for Bearer tokens: <https://datatracker.ietf.org/doc/html/rfc6750#section-5.2>

Does OAuth reuse tokens across domains? If not, doesn't this just mean it is requesting an auth token for ghrc (the "fake" domain) but it can't access any auth tokens for ghcr (the real domain)?

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous.

[1] https://docs.github.com/en/packages/working-with-a-github-pa...

Edit: most relevant issues?

https://github.com/orgs/community/discussions/38467

https://github.com/github/roadmap/issues/558

Previously on Hacker News at https://news.ycombinator.com/item?id=44974240 .

Reminder not to use goofy TLDs, being cute is not worth it when compared to security. There's no guarantees that the process for taking down a malicious domain will be as smooth as a .com.

I'd rather deal with US verisign rather than the British Indian Ocean territory or colombia or anguila

whois says it's registered by dynadot, so it's probably worth contacting their abuse email: abuse@dynadot.com

One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped.

Root cause a stupid FLA of course. For several months I thought it means Google whatever register.

Wouldn't DNSSEC solve stuff like this?

I don't get it what is ghrc and why does it matter

Ngl that's kinda badass

Honestly using something like haveibeensquatted would catch _so_ many of these, including ability to submit takedowns.

looks like it was either taken down or turned off. trying to run the same curl commands now just sits empty trying to access the IP

curl -i -v https://ghrc.io/v2/ * Trying 128.199.6.40:443...