SoylentNews is people
SoylentNews
GitHub Actions being actively abused to mine cryptocurrency on GitHub servers
GitHub Actions is currently being abused by attackers to mine cryptocurrency using GitHub's servers in an automated attack.
GitHub Actions is a CI/CD solution that makes it easy to automate all your software workflows and setup periodic tasks.
The particular attack adds malicious GitHub Actions code to repositories forked from legitimate ones, and further creates a Pull Request for the original repository maintainers to merge the code back, to alter the original code. But, an action is not required by the maintainer of the legitimate project for the attack to succeed.
BleepingComputer also observed the malicious code loads a misnamed crypto miner npm.exe from GitLab and runs it with the attacker's wallet address. Additionally, after initially reporting on this incident, BleepingComputer has come across copycat attacks targeting more GitHub projects in this manner.
Here is how it works:
The attack involves first forking a legitimate repository that has GitHub Actions enabled. It then injects malicious code in the forked version, and files a Pull Request for the original repository maintainers to merge the code back. But, in an unexpected twist, the attack does not need the maintainer of the original project to approve the malicious Pull Request.
Perdok says that merely filing the Pull Request by the malicious attacker is enough to trigger the attack. This is especially true for GitHub projects that have automated workflows setup to validate incoming Pull Requests via Actions. As soon as a Pull Request is created for the original project, GitHub's systems would execute the attacker's code which instructs GitHub servers to retrieve and run a crypto miner.
It looks like the validation of the Pull request is what triggers execution of the cryptominer. I wonder how long Github Actions will run a task before killing it?
(Score: 1, Insightful) by Anonymous Coward on Monday April 05 2021, @07:49PM (12 children)
Life finds a way, eh?
(Score: 3, Touché) by DannyB on Monday April 05 2021, @08:04PM (11 children)
I wish life could find a way to make cryptocurrency miners die off except on systems where they are welcomed. But maybe that is unwelcoming and politically incorrect.
Miners must have note from parent / guardian to work in the mines more than 16 hours / day, or on GPUs
Young people won't believe you if you say you used to get Netflix by US Postal Mail.
(Score: 0) by Anonymous Coward on Monday April 05 2021, @08:59PM (4 children)
Only if the cryptominer is black. If they're white, you can be as racist as fuck with the blessings of your democrat overlords.
(Score: 0) by Anonymous Coward on Monday April 05 2021, @09:27PM (3 children)
(Score: 0) by Anonymous Coward on Monday April 05 2021, @09:35PM (2 children)
projection, their favorite sport
kinda how we're finding out all the pedos are actually republicans and there is never any outrage from conservatives unless a democrat is blamed
truly they are disturbed people
(Score: 0) by Anonymous Coward on Monday April 05 2021, @09:49PM (1 child)
No, the Dems just get away with it. Like Hunter and Joe.
(Score: 0) by Anonymous Coward on Monday April 05 2021, @11:06PM
(Score: 4, Insightful) by Thexalon on Monday April 05 2021, @09:24PM (5 children)
How to end cryptocurrency mining:
1. Don't buy cryptocurrency, or mine it yourself.
2. Don't accept cryptocurrency as payment for your business.
3. Encourage law enforcement to take advantage of blockchain's recording technology to track down and prosecute illegal uses of cryptocurrency.
If all 3 of those happen and are widespread enough, cryptocurrency stops being valuable, and thus people will stop spending lots of real money mining it and/or stealing resources to mine it.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: -1, Troll) by Anonymous Coward on Monday April 05 2021, @09:37PM (1 child)
You Democrats love to control things, don't you?
(Score: 3, Touché) by Thexalon on Monday April 05 2021, @10:03PM
So let me get this straight: Somebody chooses by their own free will not to accept, purchase, or mine cryptocurrency, and that's me saying that I want to control people?
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 2) by inertnet on Monday April 05 2021, @11:14PM (2 children)
Why don't you require cryptocurrency miners to do their mining calculations with a pen on paper.
(Score: 2) by Thexalon on Tuesday April 06 2021, @02:18AM
That would be in fact less destructive than many of the methods miners have been using the last few years. Paper is a fairly sustainable product these days.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 0) by Anonymous Coward on Tuesday April 06 2021, @05:47AM
Pen and paper? You are going to kick of the great slide rule arms race by those coin miners. And just you wait until they rediscover Curtas.