📢 Attackers breached GitHub accounts using stolen OAuth tokens

Mike Hanley, the Chief Security Officer at GitHub, on 15th April revealed that they have discovered evidence of attackers abusing stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm.

This data breach was first discovered on 12th April, after GitHub Security began an investigation.

The applications maintained by these integrators (namely Heroku and Travis-CI) were used by GitHub users, including GitHub itself. But the actual GitHub systems were not compromised as these tokens are not stored by GitHub in their original format.

We do not believe the attacker obtained these tokens via a compromise of GitHub or its systems because the tokens in question are not stored by GitHub in their original, usable formats, says Mike.

Our analysis of other behavior by the threat actor suggests that the actors may be mining the downloaded private repository contents, to which the stolen OAuth token had access, for secrets that could be used to pivot into other infrastructure, adds Mike in his blog post.

According to Mike Hanley, here is the list of impacted OAuth applications as of April 15, 2022:

• Heroku Dashboard (ID: 145909)
• Heroku Dashboard (ID: 628778)
• Heroku Dashboard – Preview (ID: 313468)
• Heroku Dashboard – Classic (ID: 363831)
• Travis CI (ID: 9216)

According to the initial detection related to this campaign, the company believes that this API key was obtained by the attacker when they downloaded a set of private npm repositories using a stolen OAuth token from one of the two affected third-party OAuth applications described above.

As of now, the security team believes that the attacker did not modify any packages or gained access to any user account data or credentials. We are still working to understand whether the attacker viewed or downloaded private packages. npm uses a completely separate infrastructure from GitHub.com, says Mike.

If you are one of the known-affected victim users and organizations that they have discovered through their analysis, you will receive a notification email from GitHub within the next 72 hours with additional details and the next steps to proceed with. No need to worry if you don't receive any email as you are not affected by this data breach.