Hackers Stole GitHub and GitLab OAuth Tokens From Git Analytics Firm Waydev

Waydev, an analytics platform used by software companies, has disclosed a security breach that occurred earlier this month. From a report: The company says that hackers broke into its platform and stole GitHub and GitLab OAuth tokens from its internal database. Waydev, a San Francisco-based company, runs a platform that can be used to track software engineers' work output by analyzing Git-based codebases. To do this, Waydev runs a special app listed on the GitHub and GitLab app stores. When users install the app, Waydev receives an OAuth token that it can use to access its customers' GitHub or GitLab projects. Waydev stores this token in its database and uses it on a daily basis to generate analytical reports for its customers. Waydev CEO and co-founder Alex Circei told ZDNet today in a phone call that hackers used a blind SQL injection vulnerability to gain access to its database, from where they stole GitHub and GitLab OAuth tokens. The hackers then used some of these tokens to pivot to other companies' codebases and gain access to their source code projects.

But but but you can trust them

[lessSockMorePuppet]

They said so, and they're popular, so of course you can trust them implicitly! /s

If external hackers were able to access it...

[93 Escort Wagon]

It's not really an "internal" database.

Re:If external hackers were able to access it...

[phantomfive]

Especially with SQL injection. #MassFail.

SQL injection is something that should never happen, it is 100% preventable in various different ways.

Re:

[Antique Geekmeister]

Which method, exactly, still allows you access to the database to request or send any information?

Re:If external hackers were able to access it...

[phantomfive]

Query parameterization is the easiest.

Re:

[Antique Geekmeister]

I you can connect to the database enough to issue such a request, then it is accessible.

Re:

[phantomfive]

Presumably you have an application layer in-between that prevents direct access, which happened in this story. I'm not really sure what your point is tbh.

Re:

[Antique Geekmeister]

Indirect access is still access. Such indirect access is often quite poorly secured: the requirements to sanitize inputs are not done, for many reasons.

Re:

[phantomfive]

Of course. I didn't say it wasn't access, I said that SQL injection attacks are impossible with query parameterization. Other types of attacks might be possible (such as a buffer overflow in the SQL parser), but not sql injection.

Re:

[Antique Geekmeister]

I see you point. But query parameterization is not how you "allow access". It's a means to sanitize access. The distinction is vital.

Sadly, it's often done quite poorly.

Re:

[andymadigan]

"the requirements to sanitize inputs are not done, for many reasons."

I've worked for 5 companies in the past 13 years, mostly with engineering teams of 4-10 people. At any of them, the idea of writing code such that a user input string was passed, unsanitized and unescaped, to a database would have been laughable.

Properly quoting, escaping, and sanitizing strings is trivial, and built into to most frameworks used for real software development (Spring and Hibernate in the Java world, for instance).

The only r

Re:

[bad-badtz-maru]

One thing that has concerned me, at least under Postgresql, is that popular PG libraries for PHP and C# offer parameterized interfaces that are converted to inline SQL by the library.

Re:

[phantomfive]

That is concerning. In theory, escaping is sufficient, but as a practical matter it is not easy, or necessary.

Who would have thunk?

[Pascoea]

Who would have thunk that giving a 3rd party company access to your source code would end poorly?

shouldn't...

[idji]

... those keys be locked to the IP addresses of Waydev by default?

So your company measures your performance ...

[Dr. Tom]

... with the number of commits and lines of code in git

I'm *already* not working there

Isn't this supposed to fix stolen passwords?

[WoodstockJeff]

I've read repeatedly that these access tokens are supposed to "fix" the problem of authenticating apps without giving them your login credentials.

Guess it just presents a different attack vector...

Re:

[phantomfive]

Oauth solves the problem of "stolen passwords" in a few specific rare cases. For example, if you are caught in an MITM attack and someone steals your token, but doesn't use it before it times out, then you have been protected by oauth. This is like changing your password every three months.

In many (most?) other cases, you are right, the token is an extra attack vector.

Re:Isn't this supposed to fix stolen passwords?

[jrumney]

It allows you to have separate tokens for each application, so when one is compromised like this, you invalidate that token and any other apps you authorized to access your account are not affected, making cleanup after a breach a lot less hassle. With fine grained access control, it can limit the scope of what is exposed when a token is compromised like this.

Oauth2 is supposed to be secure

[mveloso]

Oauth2 alone isn't enough for security - you need IP access control and some kind of dynamic renewal process. They probably stole the access and refresh tokens, which is why they were able to continue accessing the site.

It's strange that the internal systems didn't notice excessive renewal requests, or that the renewal token was already used.

Re:

[Antique Geekmeister]

You also need a stable and verifiable IP address space from which to use the tokens. This has proven very difficult in many environments, and in other environments the process owners are simply unwilling to do the extra work or to allow someone else's automated tool to update the filters preventing access from other addresses.

Question of the day

[fustakrakich]

Has anybody ever asked whether the idea of a "data-driven" application is a good idea?

Everything is executable. Just fill out the right forms, and you can completely reprogram the computer to launch missiles

Re:

[account_deleted]

Comment removed based on user account deletion

so now software from github & gitlab

[FudRucker]

is not to be trusted because those tolkins are used for software authentication? do i need to wipe my harddrives on all my PCs because github & gitlab were cracked & jacked

Re:

[jrumney]

Github and gitlab were not hacked, waydev was. If you never authorized waydev to access your github or gitlab account, your account is not compromised.

Lines of code is so easy to game

[Anonymous Coward]

You would think that measuring a programmer's productivity by lines of code would have died out over the decades of the computer industry. A lot easier to game online than with punchcards.

Re:

[ceoyoyo]

Clearly enough programmers are not gaming that particular metric.

Waydev

[oldgraybeard]

Weren't they mentioned in another article related to a breach?