test/expected/SLASHDOT/0102639752

   1     400,000 WEBSITES VULNERABLE THROUGH EXPOSED .GIT DIRECTORIES
   2                           (SCMAGAZINE.COM)
   3
   4   Thursday September 06, 2018 @11:30PM (msmash)
   5   from the security-woes dept.
   6
   7   o News link: https://tech.slashdot.org/story/18/09/06/1954253/400000-websites-vulnerable-through-exposed-git-directories
   8   o Source link: https://www.scmagazine.com/home/news/400000-websites-vulnerable-through-exposed-git-directories/
   9
  10
  11     Open  .git  directories are a bigger cybersecurity problem than
  12     many  might  imagine,  at  least  according to a Czech security
  13     researcher  who  discovered  almost  400,000  web pages with an
  14     open  .git  directory possibly exposing a wide variety of data.
  15     From  a  report:  Vladimir  Smitka  began  his  .git  directory
  16     odyssey  in  July  when  he  began looking at Czech websites to
  17     find  how  many  were improperly configured and allow access to
  18     their  .git  folders  within the file versions repository. Open
  19     .git  directories  are a particularly dangerous issue, he said,
  20     because   they   can   contain   a   great  deal  of  sensitive
  21     information.  "Information  about  the website's structure, and
  22     sometimes  you  can  get  very  sensitive data such as database
  23     passwords,  API  keys,  development  IDE  settings,  and so on.
  24     However,  this  data shouldn't be stored in the repository, but
  25     in  previous  scans  of  various  security issues, I have found
  26     many  developers  that  do  not  follow  these best practices,"
  27     Smitka  wrote.  Smitka queried 230 million websites to discover
  28     the  390,000  allowing  access  to  their .git directories. The
  29     vast  majority of the websites with open directories had a .com
  30     TLD with .net, .de, .org and uk comprising most of the others.
  31
  32
  33   **
  34
  35      ** Re: (Score:2, Informative)
  36         (by MidSpeck ( 1516577 ))
  37
  38
  39         ^/.*/\.git/
  40         Protect git repositories in all subdirectories as well.
  41
  42
  43      ** Re: (Score:2)
  44         (by jrumney ( 197329 ))
  45
  46
  47         Why stop there? Are there any dot files/directories that need
  48         to be served over HTTP?
  49
  50
  51      ** Re: .htaccess (Score:3)
  52         (by spongman ( 182339 ))
  53
  54
  55         Why doesn't Apache block all '.'-prefixed directories by
  56         default?
  57
  58
  59   **
  60
  61      ** Re:https://slashdot.org/.git (Score:4, Informative)
  62         (by ls671 ( 1122017 ))
  63
  64
  65         Slashdot is still using CVS try [1]https://slashdot.org/CVS/
  66         [slashdot.org]
  67         you will see, it works!  :)
  68
  69
  70
  71
  72         [1] https://slashdot.org/CVS/
  73
  74
  75   ** Your central git repo ... (Score:1)
  76      (by Qbertino ( 265505 ))
  77
  78
  79      ... belongs behind ssh or, at least, behind http access and SSL.
  80      If I catch you doing otherwise for anything other than FOSS
  81      software I'll smack you. Hard.
  82
  83      ** Re:Your central git repo ... (Score:4, Informative)
  84         (by tlhIngan ( 30335 ))
  85
  86
  87         > ... belongs behind ssh or, at least, behind http access and
  88         > SSL.
  89         > If I catch you doing otherwise for anything other than FOSS
  90         > software I'll smack you. Hard.
  91         And it probably is. The thing is, the website owners are
  92         using git to version control and deploy their website (not a
  93         bad idea). So they develop their web site, push it to the
  94         central git repo, and whenever they need to go live, they
  95         just do a "git pull" on the webserver and it'll pull down the
  96         latest version of the website.
  97         Problem is, they forget about the hidden  .git directory git
  98         makes that stores all sorts of useful information and with a
  99         little persistence, allow you access to the raw source code
 100         since you can access the individual git objects. (Or maybe
 101         even clone it using git).
 102
 103         ** Re: (Score:2)
 104            (by jrumney ( 197329 ))
 105
 106
 107            I do this, it is very convenient for deploying updates to
 108            the site. But I always put the web interface into a
 109            subdirectory, and only configure the web server to see
 110            that so the  .git directory is not visible over HTTP. And
 111            dotfiles and directories are blocked in the webserver
 112            config for extra protection against accidental inclusion
 113            of invisible files.
 114
 115
 116
 117   ** reheating yesterday's food (Score:3)
 118      (by Tsolias ( 2813011 ))
 119
 120
 121      just an article from 2015 [1]https://en.internetwache.org/d...
 122      [internetwache.org]
 123      I can give you also next year's article about  .file
 124      vulnerabilities. (spoiler alert)
 125      [2]https://en.internetwache.org/s... [internetwache.org]
 126
 127
 128
 129
 130      [1]
 131      https://en.internetwache.org/dont-publicly-expose-git-or-how-we-
 132      downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-
 133      07-2015/
 134      [2]
 135      https://en.internetwache.org/scanning-the-alexa-top-1m-for-ds-st-
 136      ore-files-12-03-2018/
 137
 138   **
 139
 140      ** KKK (Score:2)
 141         (by Tsolias ( 2813011 ))
 142
 143
 144         > Thats what you get on hiring those bootcamp "graduates"
 145         Kode w/ Karlie Kloss, like it or not.
 146
 147
 148   ** Alternate headline: 99.8% websites are OK (Score:2)
 149      (by jmichaelg ( 148257 ))
 150
 151
 152      230 million websites. 400k poorly configured. 4*10^5/2.3*10^8 is
 153      less than 0.2% of websites surveyed screwed this up.
 154      400k is a big number but it's good to know most developers
 155      aren't that stupid on this issue.
 156
 157   **
 158
 159      ** Re: yarn dist (Score:2)
 160         (by TimMD909 ( 260285 ))
 161
 162
 163         ... Equifax types for free security tests from 3rd parties
 164         and press coverage, presumably...
 165
 166
 167   ** So? (Score:2)
 168      (by cshark ( 673578 ))
 169
 170
 171      An open git directory will be everything you need to reconstruct
 172      the site, more often than not from the same server you're
 173      targeting. Scary. Database servers are rarely open. Short of
 174      some serious hacking, there isn't a lot you're going to be able
 175      to do with this stuff once you've obtained the information
 176      you're waving around here.
 177      Until such time as I see hackers actually logging in with this
 178      information and defacing github, I'm going to remain unconvinced
 179      of the severity of this one.
 180
 181      ** Re: (Score:2)
 182         (by OrangeTide ( 124937 ))
 183
 184
 185         My website's  .git directories are open intentionally. Makes
 186         for convenient mirroring and viewing of archives without
 187         having to hope and pray wayback machine picked up my obscure
 188         website.
 189         I'm not too worried. It's just data on the filesystem, it's
 190         not executing programs. And the data is not supposed to
 191         contain any secrets. If it ever does then I better rewrite my
 192         git history.
 193
 194
 195      ** Re: (Score:1)
 196         (by Anonymous Coward)
 197
 198
 199         The most likely actual security implication is hard coded
 200         keys to 3rd party APIs.
 201         Not that this is an inevitable threat, itâ(TM)s just
 202         something I could see being inadvertently exposed and useful
 203         without much additional effort.
 204
 205         ** Re: (Score:1)
 206            (by Orrin Bloquy ( 898571 ))
 207
 208
 209            > itâ(TM)s
 210            Clear something up, are you typing curly
 211            quotes/apostrophes on purpose or do you have your browser
 212            configured to automatically do that.
 213
 214
 215
 216      ** Re: (Score:2)
 217         (by jonwil ( 467024 ))
 218
 219
 220         What about if that  .git folder (and the website's source
 221         code) included private keys for stuff. Or credentials/API
 222         keys for 3rd party services. Or credentials for database and
 223         other servers.
 224
 225
 226