A hacker is wiping Git repositories and asking for a ransom

zdnet.com

32 points·swamp40··7 comments

I don't understand the business model. Since git is distributed, I have a copy of the repo in my hard disk. In the shared repos, we all have copies of the repos in our hard disk. So I don't expect that too many people will pay.

Especially as they'll make the code public if you don't pay, so even if you don't have it locally there seems a free way to get it back?

While it seems to have been used indiscriminately, I guess this is really targeted at private repos.

Yes, you'll likely have several copies of the code on dev machines, but you won't want the source to be made public.

So there's an update on the story. Hacker scanned the internet for Git config files and used credentials he found inside to access accounts all over the place

"A GitHub search reveals that at least 392 GitHub repositories have been ransomed, so far."

That is a lot of pwned repos. I wonder why GitHub hasn't sorted this out yet.

Search results don't include private repos.

Wonder how many of those got hit.

Lots of security people will be up tonight reviewing logs.

Good point, we have no idea how many private repos have been compromised and I assume people won't come forward either.

The messed up part is that the repos are probably worth waaaay more than the ransom, especially if the companies are making money.

I wonder how many security people will be walking out the door TBH.

Reply on news.ycombinator.com