What does GitHub’s security team even do?
What does GitHub’s security team even do?
GitHub 的安全团队到底在做什么？
What does GitHub’s security team even do? Right now, there are thousands of repositories on GitHub distributing malware. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website. These repositories have been around for two years. GitHub has billions of dollars, a security team, and artificial intelligence. Why haven’t they solved this problem in two years?
GitHub 的安全团队到底在做什么？目前，GitHub 上有数以千计的仓库正在分发恶意软件。你们任何人都可以找到这些仓库，而且不需要任何专业知识。你所要做的只是使用 GitHub 网站上的标准搜索功能。这些仓库已经存在两年了。GitHub 拥有数十亿美元的资金、一个安全团队以及人工智能技术。为什么他们两年来都没有解决这个问题？
First, we’ll look at the repositories we’ve already found, identify common patterns within them, and then use those patterns to find other repositories. Take a look at these repositories; in each one, the readme contains a link to a zip archive containing a Trojan: https://github.com/lukasriedinger1501-alt/datahub https://github.com/marsergiovp/udif https://github.com/m4kskool/serverless-dns https://github.com/manani111/PaCoRe Link to download the zip archive containing the Trojan
首先，我们来看看已经发现的仓库，识别其中的共同模式，然后利用这些模式去寻找其他仓库。看看这些仓库；每一个仓库的 README 文件中都包含一个指向包含木马的 zip 压缩包的链接： https://github.com/lukasriedinger1501-alt/datahub https://github.com/marsergiovp/udif https://github.com/m4kskool/serverless-dns https://github.com/manani111/PaCoRe 下载包含木马的 zip 压缩包的链接
If we download this zip archive and submit individual files from it to VirusTotal, we’ll see the following results: Scanning files from the zip archive on VirusTotal
如果我们下载这个 zip 压缩包并将其中的单个文件提交到 VirusTotal，我们会看到以下结果： 在 VirusTotal 上扫描 zip 压缩包中的文件
Even a quick glance at these repositories shows that they have the same structure, nearly identical headings, and every heading contains an emoji. That’s all the information we need to find other repositories.
即使只是粗略地浏览一下这些仓库，也能发现它们具有相同的结构、几乎完全相同的标题，并且每个标题都包含一个表情符号。这就是我们寻找其他仓库所需的所有信息。
Let’s use the heading ”📥 Download” and search for that string on GitHub. But we don’t want to search the entire codebase — just the readme files. Go to github.com and enter the following in the search bar at the top: path:readme.md ”## 📥 Download”
让我们使用标题“📥 Download”并在 GitHub 上搜索该字符串。但我们不想搜索整个代码库，只想搜索 README 文件。前往 github.com 并在顶部的搜索栏中输入以下内容： path:readme.md ”## 📥 Download”
The number of results will always vary. At first, it showed me 9k repositories, but when I went to page 2, there were only 109 repositories. After refreshing the page, it was back to 9k repositories.
搜索结果的数量总是会变动。起初，它显示有 9000 个仓库，但当我翻到第 2 页时，只剩下 109 个仓库。刷新页面后，又回到了 9000 个仓库。
In the search output, you’ll need to visually filter out the results that contain any other text besides just the heading. The heading variations will look something like this:
📥 Download Now
📥 Download Now Again
📥 Download the Software
📥 Download & Install
Results of the first search
在搜索输出中，你需要通过视觉过滤掉那些除了标题之外还包含其他文本的结果。标题的变体看起来像这样：
📥 Download Now
📥 Download Now Again
📥 Download the Software
📥 Download & Install
第一次搜索的结果
Open these repositories. They will have a link to a zip archive containing a Trojan. However, the search results will include many legitimate repositories. We can improve the search by adding a search for zip archives. The search string will look like this: path:readme.md ”## 📥 Download” “.zip”
打开这些仓库。它们都会有一个指向包含木马的 zip 压缩包的链接。然而，搜索结果会包含许多合法的仓库。我们可以通过增加对 zip 压缩包的搜索来改进搜索结果。搜索字符串将如下所示： path:readme.md ”## 📥 Download” “.zip”
This will significantly improve the results. Now, right in the search results, we can see which repositories contain the heading we need and a link to a zip archive. Results of the second search
这将显著改善搜索结果。现在，直接在搜索结果中，我们就能看到哪些仓库包含了我们需要的标题以及指向 zip 压缩包的链接。 第二次搜索的结果
But these results still include legitimate repositories. How else can we refine the search query? All links to zip archives lead to githubusercontent.com or github.com. Also, the zip archive contains a version number, for example, “Software-3.6.zip”. So we just need to write a regular expression to search for such links. But as I said at the beginning, you don’t need any specialized knowledge for this. Any free AI model can handle it. We feed it 10 such links, and after a few iterations, we get this result: path:README.md /raw.githubusercontent.com/.\d+.\d+.zip|github.com/./raw/refs/heads/.*\d+.\d+.zip/
但这些结果中仍然包含合法的仓库。我们还能如何优化搜索查询？所有指向 zip 压缩包的链接都指向 githubusercontent.com 或 github.com。此外，zip 压缩包包含版本号，例如“Software-3.6.zip”。所以我们只需要编写一个正则表达式来搜索此类链接。但正如我开头所说，你不需要任何专业知识。任何免费的 AI 模型都能处理。我们给它 10 个这样的链接，经过几次迭代，我们得到了这个结果： path:README.md /raw.githubusercontent.com/.\d+.\d+.zip|github.com/./raw/refs/heads/.*\d+.\d+.zip/
Enter this query, and you’ll get the repositories that are distributing the zip archive containing the Trojan. The number of repositories varies. In my case, sometimes there are 111, sometimes 4.4k. Results of the third search
输入此查询，你就会得到正在分发包含木马的 zip 压缩包的仓库。仓库的数量会有所变动。就我而言，有时是 111 个，有时是 4400 个。 第三次搜索的结果
But this entire search only worked because we had an initial list of repositories from which we were able to derive a general search pattern. Maybe GitHub’s security team didn’t have these repositories? Maybe they don’t know about this general pattern?
但整个搜索过程之所以有效，是因为我们拥有最初的一份仓库列表，并从中推导出了通用的搜索模式。也许 GitHub 的安全团队没有这些仓库？也许他们不知道这种通用模式？
A month ago, I published an article in which I analyzed this scheme in detail. I wrote a script that found 10,000 such repositories. I published the list of all the repositories and the script on GitHub. The article made it to the Hacker News front page. Other cybersecurity websites wrote about this scheme.
一个月前，我发表了一篇文章，详细分析了这个方案。我编写了一个脚本，找到了 10,000 个这样的仓库。我在 GitHub 上发布了所有仓库的列表和该脚本。这篇文章登上了 Hacker News 的首页。其他网络安全网站也报道了这个方案。
Here is the full list of actions GitHub took: They deleted all 10k repositories that the script found. That’s it. They didn’t do anything else.
以下是 GitHub 所采取的全部行动： 他们删除了脚本找到的所有 10,000 个仓库。 仅此而已。他们没有做任何其他事情。
What’s more, a few hours later I ran the script again; it found new repositories, and I added them to the article. They weren’t blocked for an entire month. Even though all they had to do was open my article again, grab the new links, and block those repositories. That turned out to be too difficult for them.
更重要的是，几个小时后我再次运行了脚本；它发现了新的仓库，我将它们添加到了文章中。它们在一个月内都没有被封禁。尽管他们所要做的只是再次打开我的文章，获取新的链接，并封禁这些仓库。事实证明，这对他们来说太难了。
But there’s one conclusion we can draw: they’re well aware of this malware distribution scheme.
但我们可以得出一个结论：他们非常清楚这种恶意软件分发方案。
No matter how hard I try, I can’t find an answer to why this is happening. Microsoft is a corporation with billions in revenue. They have thousands of employees, limitless resources, and artificial intelligence. All they needed to do was allocate a few days for any regular employee so they could use Copilot to find all these repositories and block them.
无论我如何努力，我都找不到为什么会发生这种情况的答案。微软是一家拥有数十亿收入的公司。他们有数千名员工、无限的资源和人工智能。他们所需要做的只是分配几天时间给任何一名普通员工，让他们使用 Copilot 找到所有这些仓库并封禁它们。
I’ve never worked at a large company. And I can’t imagine how decisions are made specifically at GitHub, or what bureaucratic nightmare managers have to go through to start combating malicious repositories.
我从未在大公司工作过。我无法想象 GitHub 具体是如何做出决策的，或者管理者在开始打击恶意仓库时必须经历怎样的官僚主义噩梦。
But they deleted all 10k repositories just a few hours after the first article was published. Why did they stop and take no further action?
但他们在第一篇文章发布后仅几个小时就删除了所有 10,000 个仓库。为什么他们停下来不再采取进一步行动了呢？