Programmer hacks GitHub to prove a point

Russian programmer Egor Homakov has recently chosen a questionable tactic to prove the danger that a Ruby on Rails public key form update vulnerability poses to systems based on this popular open source web application framework: he hacked GitHub.

The story goes like this: Homakov first discovered a Ruby on Rails mass assignment vulnerability that would allow anyone to write or delete a posting, make changes in the source code of any GitHub repository or even delete its development history altogether.

After having opened an issue in the Rails repository on GitHub notifying the developers of the vulnerability, the issue was closed by them saying that the vulnerability wasn’t their problem, but that developers using the framework should work it out.

According to ZDNet, Homakov opened the same issue a couple of times more, but developers insisted in closing it down without acknowledging the legitimacy of his claim. In the meantime, he also notified GitHub’s managers of the vulnerability and the service promptly fixed it.

Angered that the Rails maintainers weren’t considering the issue to be theirs to make right, he exploited a public key form update vulnerability (based on the aforementioned mass assignment one) to create additional issues on the Rails GitHub project’s list.

He first started by playfully adding the issues and time-stamping them to seem like they were opened thousands of years from now, then continued by adding his public key to the list of Rails committers and actually push a new (innocuous) file to the Rails repository.

GitHub responded to this by suspending Homakov’s account, saying that they have blocked his “attack” on the service. But they were mainly angered by the fact that he had not disclosed this second vulnerability responsibly, and later admitted that he did not any actual damage and had only tried to make a point.

To be fair on GitHub, they did reinstate Homakov’s account after that, and have already pushed out a fix for the second vulnerability. They also changed their responsible disclosure policy to define more clearly what people should do if they want to share information about vulnerabilities with them.

Unfortunately, even though GitHub fixed the vulnerabilities in question, there are many Rails-based projects out there, and they should all start working on doing the same lest they want to be compromised.