Malicious URLs on Wiki - Githubissues

Proxmark / proxmark3

Proxmark 3

http://www.proxmark.org/

GNU General Public License v2.0

3.15k stars 906 forks source link

Malicious URLs on Wiki #1001

Closed ayancey closed 2 years ago

ayancey commented 2 years ago

Hey,

It looks like multiple people are persistently changing the URL on the wiki page for Windows installation from ProxSpace to a malicious remote access trojan.

https://github.com/Proxmark/proxmark3/wiki/Windows

Someone changed the URL from https://github.com/Gator96100/ProxSpace/archive/master.zip to https://github.com/lampii/VideoCaptureUtility/releases/download/42/master.zip

The user keeps changing their name to cover up their tracks.

pwpiwi commented 2 years ago

@0xFFFF (owner of this repository): Would it make sense to allow Wiki changes to contributors only?

ayancey commented 2 years ago

FYI, this continues to be an issue. The attacker has gone and tried to revert the change I made, re-enabling the malicious link. https://github.com/Proxmark/proxmark3/wiki/Windows/_history

AkechiShiro commented 2 years ago

Some maintainers of Proxmark3 need to step in ASAP, this is a joke that someone is toying with a security researcher project like this

0xFFFF commented 2 years ago

In response to this particular issue I have enabled:

General / Require contributors to sign off on web-based commits
General / Features / Wikis / Restrict editing to users in teams with push access only

Please inform me (just as @pwpiwi has done) if additional changes are required.

ayancey commented 2 years ago

Thank you. If anyone downloaded and ran that executable, I would highly recommend you nuke your system. The attacker got access to my password manager, and GitHub account while I was away from my computer. I opened an abuse case with GitHub to get the account terminated.