In another Fortune 500 Hacking scandal, a recent report suggests that Microsoft Corporation’s official Github account has been hacked. This attack was carried out by an infamous hacker and he allegedly breached the account for sensitive information.
Github is a popular digital community for developers around the globe, mostly used to share and safeguard their code repositories. Ironically in this case, the platform is currently owned and operated by Microsoft itself. Github provides two options to categorize your code – ‘public’ and ‘private’. Like most development companies, Microsoft also keeps private code repositories on Github but the stakes are much higher with its famous softwares & tools like Windows, Office, etc.
Microsoft Github Hackers: Who Did it?
The Microsoft Github hacking news has been credited to the Shiny Hunters, who in the past have been associated with major data-breach and hacking attacks such as Tokopedia, Minted, Homechef, StarTribune, Zoosk and others. In his most recent strike, he successfully broke into a Microsoft employee’s Github account and was able to access some private repositories.
The cyberattack came to light this past week in May, 2020 when the threat actor disclosed his ‘achievement’ by saying that he is planning to publish some of the stolen data on a hacking forum. He has allegedly stolen around 1200 private repos, accumulated as 500GB worth of code, projects, and other data.
Microsoft GitHub Hacked: Real or Fake?
Shiny Hunters had tipped Bleeping Computer of this act and told that originally he wanted to sell the data, but will now divulge it for free. They received the Proof of Access as below screencaps:
Upon further analysis of the time stamps, it was discovered that the breach took place on March 28, 2020. As further evidence, ZDNet acquired 3 private Microsoft projects full source code and files.
With advanced investigation into the matter, many Microsoft software engineers and other employees confirmed that part of the leaked data is legitimate, and was in fact part of their Github’s private repos. But so far nothing substantial was included in the leaked Microsoft Github data dump. A source clarified that Microsoft generally stores all major projects internally, rather than on their public Github account. To put an exclamation on these speculations, one of the Microsoft’s current employee has publicly commented:
Though Microsoft is currently examining the case in-house, they haven't released any official statement yet. A big chunk of the Microsoft team had tweeted and spoken out that this ‘hack news’ is nothing but a scam. But since more proofs and verifications are rolling out, all those defending, have deleted/ taken back their statements.
But amidst all the chaos, one thing is for sure, that the hackers haven’t gained anything of much value out of this ordeal. As stated above, Microsoft always hosts important project code and information in-house, and the private GitHub will merely contain data that has to go public in near-future. The only important spill might be few API credentials and access tokens.
In the last received update, Microsoft has identified the vulnerable GitHub account, after which Shiny Hunters has seemed to have lost the Microsoft Github private repository access.
