Millions of GitHub repos likely vulnerable to RepoJacking, researchers say

bleepingcomputer.com

17 points·DemiGuru··5 comments

The same problem exists, but has less of an impact on other platforms as well. For example, switching to a domain based handle on Bluesky will make your old handle available for re-registration. That makes you vulnerable to impersonation via the old handle.

I wonder if some of these platforms could allow aliases, so, using the example in the article, switching from 'MyOrganization' to 'NewOrganization' lets you keep 'MyOrganization' as a permanent alias. Obviously that would invite namespace squatting, but I think you could solve that by charging a one time fee for an alias. If you're renaming an organization it's likely worth $50+ to keep the old namespace.

Ideally, everything should move to domains as namespaces IMO. I'd rather maintain a single domain vs (hopefully) matching namespaces across a dozen different platforms.

I reported this problem 5 years ago. GitHub employed some half fixes and called it a day.

https://news.ycombinator.com/item?id=16343926

https://www.theregister.com/2018/02/10/github_account_name_r...

https://donatstudios.com/GithubsTotalSecurityFacepalm

So, to mitigate, avoid changing Github organization names if possible, and if not, preserve / re-register the former organization name to prevent impersonation?

If you don't have a lot of projects, it may be better to transfer them into a newly registered organization because that doesn't require a temporary drop of the namespace. Either way, you'll break the redirect, but that's better than being vulnerable to impersonation IMO.

This is why it is important to use checksums/hashes when automatically pulling stuff from external sources.

Reply on news.ycombinator.com