As a result of a vulnerability in the open-source development tool Git, about 332,000 websites were exposed to bad actors putting various organizations at risk of online attacks and unauthorized use of data. Out of these, 2,500 websites were linked to .gov domains in different countries.
The Git project leaders published an update in April to address a number of security flaws including a vulnerability that affected users on multi-user machines and another one affecting the Git uninstaller. However, it was found that the real issue lies with how the tools are being used. The vulnerability is caused by users not protecting their files with proper antivirus protocols, for example, leaving hidden .git files exposed to search engines. As open-source tools are the most basic of any program’s code, it is easy to tamper with them, if not secure. They can be easily hacked into and accessed by hackers, who can then download data from government agencies.
If hackers are able to gain access to the .git directory and the files contained within, they can download complete codebase history, including past code changes, comments, security keys, as well as sensitive remote paths containing confidential files and plain-text passwords. Some folders contain information like login credentials and API keys which can give bad actors access to even more sensitive information. Even gaining access to the source code of a website will enable hackers to spoof or find more vulnerabilities to execute an even more severe attack.
Some organizations tend to leave certain folders open for their specific purposes. However, there are still many other organizations that could be at the risk of an unintentional data breach.
It was previously found that another popular open-source application, Log4j, used by developers to record user activity and the behavior of applications, allows attackers to execute code remotely on a target computer, leading the attacker to steal data, install malware or take control. The Cyber Safety Review Board (CSRB) has labeled Log4j as an ‘endemic’ that will continue for another decade.
Git is a popular open-source application used for version control and website development. It has over 80 million active users. This reminder can be for organizations to update their antivirus protocols, especially when it comes to open-source programs. Organizations that are not following cybersecurity best practices are risking their safety and privacy.
