Bitcoin
$47,579.86-0.85%
Ethereum
$3,359.35-1.17%
XRP
$1.08+0.51%
Cardano
$2.32-1.92%
Polkadot
$34.27-1.07%
Stellar
$0.318514-0.11%
Dogecoin
$0.236629-1.32%
Chainlink
$27.73-0.97%
Uniswap
$24.02-0.29%
Polygon
$1.34-0.88%
Litecoin
$176.96-1.62%
Bitcoin Cash
$616.86-0.82%
Cosmos
$42.20+3.93%
Algorand
$1.00-2.46%
Wrapped Bitcoin
$47,558.55-0.93%
Filecoin
$84.14+1.07%
The Graph
$0.821279-1.13%
Tron
$0.105328+0.36%
Ethereum Classic
$56.23-0.81%
Tezos
$6.64+3.61%
Aave
$347.93-0.24%
EOS
$5.07-5.71%
NEO
$48.82-0.61%
Monero
$266.41-0.57%
IOTA
$1.56-3.65%
BitTorrent
$0.003880-1.38%
Bitcoin SV
$156.51-0.08%
Waves
$27.96-2.56%
Maker
$2,801.76-0.30%
Dash
$197.19-0.40%
Decred
$141.66-0.82%
Decentraland
$0.809568-0.70%
ICON
$1.84-2.47%
NEM
$0.181514-0.72%
Zcash
$136.09-1.07%
OmiseGO
$9.70+12.14%
Qtum
$12.33-0.52%
NuCypher
$0.326645-2.08%
Yearn Finance
$33,373.54-0.68%
Bitcoin Gold
$64.76-1.95%
Basic Attention Token
$0.744513-0.61%
0x
$1.08-0.95%
Paxos Standard
$0.999369-0.10%
Bancor
$3.00-1.04%
Ren
$0.916651-4.16%
Band Protocol
$9.16-0.49%
Fetch.ai
$0.783215-4.51%
Siacoin
$0.018387-2.41%
Kava.io
$6.08-2.42%
Nano
$5.55+2.48%
Loopring
$0.462404+1.87%
Storj
$1.36-1.34%
Lisk
$3.63+2.19%
Civic
$0.513005-3.52%
Numeraire
$45.05-2.72%
Orchid
$0.374257-6.36%
PAX Gold
$1,768.72+0.07%
Augur
$25.57-2.55%
Aragon
$6.07-0.60%
Enzyme
$119.51+2.15%
district0x
$0.176755-0.19%
Kyber Network
$1.76-2.31%
SingularDTV
$0.001451-2.59%
Tether
$1.00+0.01%
USD Coin
$1.00+0.03%
Dai
$1.00+0.04%

Hackers Mined Crypto on GitHub's Servers: Report

The activity was first noticed in November, according to the report.

Apr 5, 2021 at 11:52 a.m. UTC
Updated Sep 14, 2021 at 12:35 p.m. UTC

Hackers have been using GitHub cloud infrastructure to covertly mine multiple cryptocurrencies, The Record reported.

The attacks were first spotted by a French software engineer in November, a fact the development platform's team confirmed to The Record last week via email.

The attack abused a GitHub feature called GitHub Actions, which allows users to automatically execute tasks and workflows triggered by a certain event happens inside their repositories. To launch crypto mining software, the attackers would fork an existing repository, add malicious GitHub Actions element to the original code, and then file a Pull Request with the original repository to merge the code back into the original, The Record wrote.

The original project owner didn't have to approve the malicious Pull Request because right after it was filed GitHub’s systems would read the attacker’s code and launch a virtual machine, which would download and run crypto-mining software, as Dutch security engineer Justin Perdok told The Record. He added that "attackers spin up to 100 crypto-miners via one attack alone, creating huge computational loads for GitHub’s infrastructure."

The mining software, according to screenshots published by The Record, included SRBMiner, a software for mining multiple cryptocurrencies using easy-to-buy consumer hardware, namely GPUs and CPUs.

In any case, it looks like the attackers didn't look to damage the repositories in any way, only to get free coins using GitHub servers, the report reads.

DISCLOSURE

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups.

Loading...