Redhat Security Breach

[mysticsniper]

Looks like redhat have suffered a breach and are the attackers are trying to extort.

Bad news for any corporate customers

https://cybernews.com/security/red-hat-breach-might-affect-major-organizations/

 

[Sinbad2000]

Red faces under red hats ...

Yow. This is not good.

 

[Rainmaker]

Ouch, that's embarrassing for them. The NSA must be very pleased. Glad I stuck with Alma now, but somehow I doubt I qualify as a big fish lol.

 

[KompuKare]

So a "private" GitHub repo is not so private after all. Surely a company as large as Red Hat should have hosted this themselves? They should have plenty of security experts in-house.

Wonder how this was breached? Were these files which Red Hat's customers had direct access to, not that makes it necessarily extra weak unless everyone had the same credentials? On the other hand if this was just Red Hat's internal storage them why wasn't it restricted to only their IPs?

Equally embarrassing that someone like the NSA lets this kind of thing out of house as I'd really expect them to have everything in-house!

 

[mysticsniper]

So a "private" GitHub repo is not so private after all. Surely a company as large as Red Hat should have hosted this themselves? They should have plenty of security experts in-house.

Wonder how this was breached? Were these files which Red Hat's customers had direct access to, not that makes it necessarily extra weak unless everyone had the same credentials? On the other hand if this was just Red Hat's internal storage them why wasn't it restricted to only their IPs?

Equally embarrassing that someone like the NSA lets this kind of thing out of house as I'd really expect them to have everything in-house!

You'll find a lot of agencies have repo's on GitHub.

Red Hat have released a statement

https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance

 

[Cromulent]

So a "private" GitHub repo is not so private after all. Surely a company as large as Red Hat should have hosted this themselves? They should have plenty of security experts in-house.

They use GitLab not GitHub.

Edit: GitLab can be self hosted so can be completely private.

 

[deviation]

Glad I stuck with Alma now

You might regret that, she's always watching

 

[KompuKare]

They use GitLab not GitHub.

I blame The Register!
Although others may have made the same mistake. Still don't go there often but in the days of the tech media being far too friendly to all big companies, The Register's more jaundiced articles are refreshing.