Hacker News Reader

Comment by bibinou | Hacker News Reader

Hi Yogi, I'm guessing your Github account has been hijacked.

Support won't respond to your emails because it could be the attacker impersonating you, or he could still have access to your email and get info that way.

This is Standard Operating Procedure I've seen applied on stolen accounts in MMO videogames involving stolen credit cards and organized crime. Sometimes wait time was 6 months with no contact, because they needed to keep the evidence under seal for the police investigation and avoid tipping off the attackers.

Your 2-letter nickname and access to important projects makes your account a high-value target.

Did you have 2FA enabled?

edit: usually the email account got hijacked first, defeating the 2FA/1-time token. SMS is also easily hackable.

View on HN

If GitHub really has reason to suspect that op's account is hijacked, they should be able to figure out at least one of op's email address (simply by the fact that email address is attached to the account long before the hijacking happened), and send some communications there? Or provide an official process of "we suspended your account because we have reason to suspect that your account is hijacked. we won't response to your emails either, this is how to contact us to have your account reinstated"?

Also op said they do have 2fa, which makes this excuse even poorer.

A malicious party could have access to OP's other accounts, maybe OP reuses passwords. It's in the realm of plausibility that they are being cautious not to alert the attacker. If they/authorities want to use the opportunity to observe and collect evidence then I think these actions on GitHub's part are somewhat reasonable, albeit kind of shitty.

If the account has been hijacked then they should go out of their way to establish the identity of the original owner rather than to try to wipe it all under the carpet. Having accounts that can be hijacked is a failure of the service provider, not of their users.

> Your 2-letter nickname and access to important projects makes your account a high-value target.

For sure this. People go crazy for this stuff and sell access on the dark web (https://gimletmedia.com/shows/reply-all/v4he6k/)

looking at http://web.archive.org/web/20200704143044/www.github.com/yg, OP had (some) access to @EpicGames, @Jekyll and some Nvidia org.

Yes I have 2FA and MFA enabled!

Another vector is takeover requests via their name squatting policy (that's how I got my username). But those requests shouldn't be approved unless the old account really is inactive. Might have been approved by mistake.

Another vector is the as of yet unfixed GitHub "ghost" bug, which I discovered and detailed here: https://github.com/git-rest/spooky

Note how you can read that repo, but the account https://github.com/git-rest doesn't exist.

OP got his 2-letter handle via a takeover request: https://dev.to/yg/how-i-got-two-letter-username-on-github-i1...

edit: the ghost repo is cool trick. Is there a writeup anywhere?

The OP changed his username in github less than a month ago to to the name of an inactive account? Perhaps the previous user is complaining.

Yeah, but it's not like he did something nefarious. He found an account that was inactive and requested it from support and they gave it to him. If the previous user complained, either he would get to keep it or the previous user would get it - it wouldn't be deleted/disabled and they probably would have communicated something.

The ghost repo trick sounds similar to a subdomain takeover. I can foresee this being a vector for publishing malicious code.

does this mean that if I pass away, someone can take over my username and repos under my account ?

No, from my experience even a single empty repo disqualifies you from takeover. The point is to prevent name squatting, i.e. registering a name and then going nothing with it.

Reply on news.ycombinator.com