Abusing GitHub for fun and profit: Actions and Codespaces Security
summary
Demonstrates concrete abuses: GitHub Codespaces gives two free instances and ~60 core hours per month with 30‑day retention and a 40‑minute idle timeout, and its devcontainer.json postStart hooks plus public port forwarding to preview.app.github.dev let attackers spin ephemeral file servers and host malware; defenders find a Rust infostealer exfiltrating to Codespaces and see xmrig miners on Windows, Linux and macOS runners, netcat reverse shells and nmap scans, and over 100+ repos running miners using xmrig and third‑party actions; checks to add: scan container images, restrict tokens, and disable untrusted Actions.
AI-written summary · about
chapters (17)
- 0:00Intro
- 5:08Infection Chain of GitHub/Netlify Abuse
- 13:34Automate w/ Dev-Containers & GitHub CLI
- 15:11Attacker's Dev-Container Config
- 18:32Malware Abusing Codespaces
- 21:46Actions Overview
- 26:19GHA Marketplace
- 30:44Abusing Windows Runners pt 2
- 32:22List of repos with the SAME code!
- 33:42Abusing Linux Runners
- 35:13Abusing macOS Runners
- 41:30Run nmap inside the Azure network
- 43:02Reverse shell from the Runner
- 44:13Pivot attacks using Runners
- 45:02Malicious GitHub Actions
- 47:10GHA Countermeasures
- 50:06Codespaces Recommendations
related talks
57mGitHub Actions: Vulnerabilities, Attacks, and Counter-measures
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?
36mGithub Actions Security Landscape
23mBreaking the Build: How Attackers Abuse GitHub Actions
28mPwning the CI (with GitHub Action Workflows)
17mIs My (Open Source) Project Safe?
51mCoding in the Cloud with GitHub Codespaces