Programmers are said to have been affected by ransomware that apparently smears their Git repositories’ commits, replacing them with a ransom note challenging Bitcoin.

An extraordinarily high number of developers have complained online about the impacts of the software foul, with the repos affected being hosted across a number of platforms, from GitHub and GitLab to Bitbucket. Therefore, it’s possible the malware is targeting involuntarily ill secured repositories instead of a specific flaw.

At least, confirm your repos are protected using multi-factor verification, and do not leak any access tokens or passwords in your public configuration files.

One victim on Reddit this week said that he had done fixing a victim. “I was using sourcetree to push the changes, as soon as I clicked the commit button my laptop freezed (it usually freezes so im not sure if it was due to malware or the usual one) and i immediately restarted it by long pressing the power button,” he added.

The victim went on to say that the ransom note they received referenced gitsbackup[dot]com, and demanded about $560 in crypto-currency to un-fsck the repo.

Another posted on Stack Exchange: “One of my repos was wiped today and just a message left in its place with a bitcoin ransom. I’ve no idea how they accessed my account, can’t really see anything on github security page.”

The user added: “I’m at a bit of a loss just now as what to do, 2 factor has been turned on in github, the main server where the code was used. I’ve removed unused scripts etc changed passwords, currently building a new server droplet and moving everything as a precaution in case the server was accessed.”

A third, Stefan Gabos, wrote on Stackexchange: “I was working on a project and suddenly all the commits disappeared and were replaced with a single text file.”

Gabos added that he was “using SourceTree but somehow I doubt that SourceTree is the issue, or that my system (Windows 10) was compromised. I’m not saying it’s not that, it’s just that I doubt it.” He told El Reg he is running the most recent version of Sourcetree (3.1.3), having updated today from the previous version. The changelog is here.

Gabos added on Stackexchange that his code does not appear to have gone altogether as accessing his commit’s hash had worked, concluding: “So the code is there but there’s something wrong with the HEAD.” He continued to note that git reflog “shows all my commits”, updating as he learned more in his quest to recover his commits. In an edit, he added.

Leave a Reply

Your email address will not be published. Required fields are marked *