Countering a Cyberattack tldr: don't allow users to use…
0 reactions
Countering a Cyberattack
tldr: don't allow users to use your GitHub token unrestricted.
Hi!
I just wanted to share this experience I had today (technically yesterday night).
\### What I did wrong
Basically didn't want to deal with the hassle of storing & converting suggestions/submissions/reports into issues. I figured I could just use a fine-grained token from GitHub and put it in my serverless worker to submit issues directly to the repo. That way, users won't have to signin/signup to GitHub to submit issues.
\### Cherry on top
Basically, I posted about the GitHub token setup, and how overwhelmed I am currently with issues. Basically, I handed what will get to me on a silver platter to any bad actor.
\### The attack
Around \~11:30pm today, I was receiving alerts that I issues were submitting at an abysmal rate. I'm talking each time I refresh, there's 100 additional issues.
\### The counter
I've dealt with cyberattacks before at my job, so all I had to do was revoke the token, setup a Python automation to close the offending issues, and put on some music to delete the issues.
Obviously that's not enough to thwart a future attack, so I went an extra step and setup rate-limiting and IP bans.
\### Reflection
It's kinda cool to see someone put effort into bothering you for whatever reason. It's a pretty dumb mistake I'll be the first to admit that. I'm taking this as a lesson to think twice before exposing a powerful token to the end-users.
#programming #dev #technology
source
tldr: don't allow users to use your GitHub token unrestricted.
Hi!
I just wanted to share this experience I had today (technically yesterday night).
\### What I did wrong
Basically didn't want to deal with the hassle of storing & converting suggestions/submissions/reports into issues. I figured I could just use a fine-grained token from GitHub and put it in my serverless worker to submit issues directly to the repo. That way, users won't have to signin/signup to GitHub to submit issues.
\### Cherry on top
Basically, I posted about the GitHub token setup, and how overwhelmed I am currently with issues. Basically, I handed what will get to me on a silver platter to any bad actor.
\### The attack
Around \~11:30pm today, I was receiving alerts that I issues were submitting at an abysmal rate. I'm talking each time I refresh, there's 100 additional issues.
\### The counter
I've dealt with cyberattacks before at my job, so all I had to do was revoke the token, setup a Python automation to close the offending issues, and put on some music to delete the issues.
Obviously that's not enough to thwart a future attack, so I went an extra step and setup rate-limiting and IP bans.
\### Reflection
It's kinda cool to see someone put effort into bothering you for whatever reason. It's a pretty dumb mistake I'll be the first to admit that. I'm taking this as a lesson to think twice before exposing a powerful token to the end-users.
#programming #dev #technology
source
| 1,000 mlx | |
| 2 | |
| 0 |