Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Hacker group ShinyHunters claims to have breached Rockstar Games' secured cloud servers via a security flaw in a third-party service, Anodot, demanding a ransom by April 14 or threatening to leak corporate data. Rockstar confirmed a data breach occurred but stated that only a limited amount of non-material company information was accessed, with no impact on their organization or players.
GitHub allows access to data from deleted and private repositories due to its repository architecture. This includes data from deleted forks and commits linked to public repositories, leading to potential exposure of sensitive information. A new term, Cross Fork Object Reference (CFOR), describes vulnerabilities where one fork can access another's sensitive data. Examples highlight that such data remains accessible even after deletion, primarily through known commit hashes. GitHub policies confirm this design, posing serious security implications for public repository users, as misuse could lead to leakage of confidential information. Key rotation is advised for secure handling of exposed secrets.
Anyone can Access Deleted and Private Repository Data on GitHub
