An alarming security breach has been identified in the OVHcloud command-line interface (CLI) tool, where a hacker exploited a GitHub account to replace download archives with malicious versions. These altered releases were designed to extract confidential data from the systems on which they were executed. The incident occurred on October 19, with the compromised files available for a brief period.
Details of the Breach
The unauthorized files were accessible on GitHub from 12:47 to 14:21 UTC, affecting users who downloaded or updated the OVHcloud CLI during this timeframe. The compromised files targeted macOS, Linux x86_64, and arm64, as well as Windows x86_64 platforms. Immediately after detection, OVHcloud removed these files and issued a secure version, v0.16.0, to prevent further exploitation.
The breach involved replacing six critical files across several releases, specifically targeting versions v0.11.0 to v0.15.0. The attacker did not alter the source code or the build pipeline, suggesting a direct upload of malicious builds onto these releases. Users who installed the CLI tool via certain methods during this period may have been exposed to the malware.
Identifying and Addressing the Exposure
Those potentially affected include users who executed the official installation script or downloaded archives directly from the GitHub release page. Continuous integration jobs that fetched archives without verifying hashes were also susceptible. Conversely, users utilizing Homebrew or those who had versions installed before the breach window were not affected.
To identify compromised installations, users can inspect build information using the go version -m command. Indicators of compromise include specific pseudo-version strings and mismatched commit identifiers. Affected users are urged to consider all secrets on their machines as exposed and to rotate them immediately.
Preventive Measures and Future Security
OVHcloud has advised users to upgrade to the new immutable release and verify the integrity of downloaded archives. They have also enabled release immutability settings to prevent future unauthorized modifications. The company is committed to conducting a thorough investigation and sharing a comprehensive postmortem report.
The breach highlights significant vulnerabilities in GitHub’s release management, where permissions allowed the unauthorized upload of altered files. OVHcloud’s swift response underlines the importance of robust security protocols and the need for organizations to ensure the integrity of their software distribution channels.
While the extent of the compromise remains under investigation, the incident serves as a critical reminder of the persistent threats in the digital landscape and the necessity for vigilance and rapid response strategies.
