GitHub bans weak passwords after brute-force attack results in compromised accounts

Some GitHub accounts had their passwords, access tokens and SSH keys reset

Popular source code repository service GitHub has recently been hit by a brute-force password-guessing attack that successfully compromised some accounts.

"We sent an email to users with compromised accounts letting them know what to do," GitHub security engineer Shawn Davenport said in a blog post. "Their passwords have been reset and personal access tokens, OAuth authorizations, and SSH keys have all been revoked."

Users were advised to review their account's Security History page for recent changes made to their repositories or failed log-in attempts and to enable two-factor authentication.

GitHub stores passwords securely using the bcrypt function and uses an aggressive rate limit for log-in attempts specifically to block password-guessing attacks, Davenport said. However, in this recent incident almost 40,000 unique Internet Protocol addresses "were used to slowly brute force weak passwords or passwords used on multiple sites."

This suggests that attackers might have taken lists of usernames and passwords leaked from other websites and used a botnet to try them out on GitHub.

A recent data breach at Adobe resulted in a file with the log-in credentials of 150 million users being leaked on the Internet. The passwords in that file were encrypted, but researchers said the encryption method used by Adobe made it possible for attackers to guess many of the passwords.

The exact number of GitHub accounts that had their passwords reset was not disclosed and GitHub did not immediately respond to an inquiry seeking clarification.

"Out of an abundance of caution, some user accounts may have been reset even if a strong password was being used," Davenport said. "Activity on these accounts showed logins from IP addresses involved in this incident."

GitHub plans to implement additional rate-limiting measures and will no longer allow users to log in with "commonly-used weak passwords," Davenport said.

This suggests that in addition to users directly affected by this recent incident, users who used weak passwords might also be forced to change them.

GitHub's sign-up page says passwords need to be at least seven characters long and have at least one lowercase letter and one numeral. Trying some weak passwords that meet that criteria like q1w2e3r4, password1 and iloveyou2 results in a message saying those passwords are "commonly guessed by hackers."

However, the blacklist doesn't seem to be very extensive, as other passwords that are technically weak like password2, 1l0v3y0u or p4ssw0rd are accepted.

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusionGitHubonline safetysecurityAccess control and authenticationadobe

More about SSH

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place