Cloud Threats Memo: A Recent Campaign Exploiting Digital Trust Through Github

Be the first to receive the Cloud Threats Memo directly in your inbox by subscribing here.

The weaponization of digital trust involves exploiting an application or tool we use in our daily digital life to perform our business or personal tasks for malicious purposes. It is a technique increasingly used by the threat actors to carry out malicious actions such as the delivery of malware or links to phishing pages.

Cloud applications are among the tools that we use in our digital life the most, and consequently they have become a launchpad for opportunistic and targeted cyber criminal campaigns: the attackers exploit the popularity of the app, the fact that these apps are trusted by humans and legacy security technologies (i.e. they are whitelisted), and as an additional bonus they also offer a simplified, resilient, and always available hosting infrastructure, compared to a traditional hosting infrastructure.

So it is no coincidence that some of the most popular cloud apps are also the most exploited by the attackers. In particular, among the top abused apps, GitHub seems to be on a roll, and a recent campaign unearthed by security researchers at VulnCheck in early May confirmed this trend. In fact the researchers stumbled upon a malicious GitHub repository that claimed to be a Signal zero-day. Despite the repository being reported to GitHub, and immediately taken down, the same scenario continued throughout May.

In the second wave, the attackers raised the bar and put significant effort into making the malicious repositories look legitimate by creating a network of accounts and Twitter profiles, pretending to be part of a non-existent security company, and even using headshots of legitimate security researchers from real security companies. This is an example of how the weaponization of digital trust might involve multiple stages, requiring not only the abuse of a legitimate service, but also the creation of a realistic environment around it involving fake personas and the impersonation of legitimate brands. It’s also a demonstration that protecting organizations from the weaponization of digital trust requires not only technology, but also education: everybody should be considered a potential target and evaluate carefully when downloading content from the internet, also from apparently trusted sources. And this is a general rule that does not apply only to developers downloading code from GitHub.

How Netskope mitigates the risk of legitimate cloud services exploited by threat actors

With regards to the risk that can be mitigated with a technological countermeasure, GitHub is one of the thousands of cloud services, where the Netskope Next Gen SWG can provide granular access control, threat protection, and DLP capabilities, and also one of the hundreds of apps for which instance detection is also available.

Organizations might decide to completely block access to the unneeded cloud service, or simply prevent specific, potentially dangerous activities (such as “Download” or “Upload”). For services like GitHub where instance detection is also available it is possible to configure a policy that prevents potentially dangerous activities and apply it to non-corporate instances only. 

But if the access to apps like GitHub is needed within the organization, Netskope customers are also protected against malware distributed from a legitimate cloud service and the web in general by Netskope Threat Protection. Netskope Threat Protection scans web and cloud traffic to detect known and unknown threats with a comprehensive set of engines, including signature-based AV, machine learning-based detectors for executables and Office documents, and sandboxing, including patient zero protection.

Netskope Cloud Exchange provides powerful integration tools to leverage investments across users’ security posture through integration with third-party tools, such as threat intelligence feeds and endpoint detection technologies.

Finally, Netskope Advanced Analytics provides specific dashboards to assess the risk of rogue cloud instances being exploited to deliver malware or the risk of becoming the target of anomalous communications, with rich details and insights, supporting security teams in the analysis and mitigation/remediation process.

Stay safe!