</head>
<body>
<div class='story'>
- <h1>400,000 Websites Vulnerable Through Exposed .git Directories (scmagazine.com)</h1>
+ <h2>400,000 Websites Vulnerable Through Exposed .git Directories (scmagazine.com)</h2>
<div class='details'>(Thursday September 06, 2018 @11:30PM (msmash)
from the security-woes dept.)</div>
<br/>
<ul>
+ <li>Reference: <a href=''>0102639752</a></li>
<li>News link: <a href='https://tech.slashdot.org/story/18/09/06/1954253/400000-websites-vulnerable-through-exposed-git-directories'>https://tech.slashdot.org/story/18/09/06/1954253/400000-websites-vulnerable-through-exposed-git-directories</a></li>
<li>Source link: <a href='https://www.scmagazine.com/home/news/400000-websites-vulnerable-through-exposed-git-directories/'>https://www.scmagazine.com/home/news/400000-websites-vulnerable-through-exposed-git-directories/</a></li>
</ul>
</div>
<hr/>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2></h2>
+ <h3></h3>
<div class='by' style='font-style: italic;'></div>
<div class='comment_content'></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: (Score:2, Informative)</h2>
+ <h3>Re: (Score:2, Informative)</h3>
<div class='by' style='font-style: italic;'>by MidSpeck ( 1516577 )</div>
<div class='comment_content'><p></p><p>^/.*/\.git/</p><p>Protect git repositories in all subdirectories as well.</p></div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: (Score:2)</h2>
+ <h3>Re: (Score:2)</h3>
<div class='by' style='font-style: italic;'>by jrumney ( 197329 )</div>
<div class='comment_content'><p></p><p>Why stop there? Are there any dot files/directories that need to be served over HTTP?</p></div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: .htaccess (Score:3)</h2>
+ <h3>Re: .htaccess (Score:3)</h3>
<div class='by' style='font-style: italic;'>by spongman ( 182339 )</div>
<div class='comment_content'><p></p><p>Why doesn't Apache block all '.'-prefixed directories by default?</p></div>
</div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2></h2>
+ <h3></h3>
<div class='by' style='font-style: italic;'></div>
<div class='comment_content'></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re:https://slashdot.org/.git (Score:4, Informative)</h2>
+ <h3>Re:https://slashdot.org/.git (Score:4, Informative)</h3>
<div class='by' style='font-style: italic;'>by ls671 ( 1122017 )</div>
<div class='comment_content'><p></p><p>Slashdot is still using CVS try [1]https://slashdot.org/CVS/ [slashdot.org]</p><p>you will see, it works! :)</p><p></p><p></p><p></p><p></p><p>[1] https://slashdot.org/CVS/</p></div>
</div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Your central git repo ... (Score:1)</h2>
+ <h3>Your central git repo ... (Score:1)</h3>
<div class='by' style='font-style: italic;'>by Qbertino ( 265505 )</div>
<div class='comment_content'><p></p><p>... belongs behind ssh or, at least, behind http access and SSL.</p><p>If I catch you doing otherwise for anything other than FOSS software I'll smack you. Hard.</p></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re:Your central git repo ... (Score:4, Informative)</h2>
+ <h3>Re:Your central git repo ... (Score:4, Informative)</h3>
<div class='by' style='font-style: italic;'>by tlhIngan ( 30335 )</div>
<div class='comment_content'><p></p><p>> ... belongs behind ssh or, at least, behind http access and SSL.</p><p>> If I catch you doing otherwise for anything other than FOSS software I'll smack you. Hard.</p><p>And it probably is. The thing is, the website owners are using git to version control and deploy their website (not a bad idea). So they develop their web site, push it to the central git repo, and whenever they need to go live, they just do a "git pull" on the webserver and it'll pull down the latest version of the website.</p><p>Problem is, they forget about the hidden .git directory git makes that stores all sorts of useful information and with a little persistence, allow you access to the raw source code since you can access the individual git objects. (Or maybe even clone it using git).</p></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: (Score:2)</h2>
+ <h3>Re: (Score:2)</h3>
<div class='by' style='font-style: italic;'>by jrumney ( 197329 )</div>
<div class='comment_content'><p></p><p>I do this, it is very convenient for deploying updates to the site. But I always put the web interface into a subdirectory, and only configure the web server to see that so the .git directory is not visible over HTTP. And dotfiles and directories are blocked in the webserver config for extra protection against accidental inclusion of invisible files.</p></div>
</div>
</div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>reheating yesterday's food (Score:3)</h2>
+ <h3>reheating yesterday's food (Score:3)</h3>
<div class='by' style='font-style: italic;'>by Tsolias ( 2813011 )</div>
<div class='comment_content'><p></p><p>just an article from 2015 [1]https://en.internetwache.org/d... [internetwache.org]</p><p>I can give you also next year's article about .file vulnerabilities. (spoiler alert) [2]https://en.internetwache.org/s... [internetwache.org]</p><p></p><p></p><p></p><p></p><p>[1] https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/</p><p>[2] https://en.internetwache.org/scanning-the-alexa-top-1m-for-ds-store-files-12-03-2018/</p></div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2></h2>
+ <h3></h3>
<div class='by' style='font-style: italic;'></div>
<div class='comment_content'></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>KKK (Score:2)</h2>
+ <h3>KKK (Score:2)</h3>
<div class='by' style='font-style: italic;'>by Tsolias ( 2813011 )</div>
<div class='comment_content'><p></p><p>> Thats what you get on hiring those bootcamp "graduates"</p><p>Kode w/ Karlie Kloss, like it or not.</p></div>
</div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Alternate headline: 99.8% websites are OK (Score:2)</h2>
+ <h3>Alternate headline: 99.8% websites are OK (Score:2)</h3>
<div class='by' style='font-style: italic;'>by jmichaelg ( 148257 )</div>
<div class='comment_content'><p></p><p>230 million websites. 400k poorly configured. 4*10^5/2.3*10^8 is less than 0.2% of websites surveyed screwed this up.</p><p>400k is a big number but it's good to know most developers aren't that stupid on this issue.</p></div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2></h2>
+ <h3></h3>
<div class='by' style='font-style: italic;'></div>
<div class='comment_content'></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: yarn dist (Score:2)</h2>
+ <h3>Re: yarn dist (Score:2)</h3>
<div class='by' style='font-style: italic;'>by TimMD909 ( 260285 )</div>
<div class='comment_content'><p></p><p>... Equifax types for free security tests from 3rd parties and press coverage, presumably...</p></div>
</div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>So? (Score:2)</h2>
+ <h3>So? (Score:2)</h3>
<div class='by' style='font-style: italic;'>by cshark ( 673578 )</div>
<div class='comment_content'><p></p><p>An open git directory will be everything you need to reconstruct the site, more often than not from the same server you're targeting. Scary. Database servers are rarely open. Short of some serious hacking, there isn't a lot you're going to be able to do with this stuff once you've obtained the information you're waving around here.</p><p>Until such time as I see hackers actually logging in with this information and defacing github, I'm going to remain unconvinced of the severity of this one.</p></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: (Score:2)</h2>
+ <h3>Re: (Score:2)</h3>
<div class='by' style='font-style: italic;'>by OrangeTide ( 124937 )</div>
<div class='comment_content'><p></p><p>My website's .git directories are open intentionally. Makes for convenient mirroring and viewing of archives without having to hope and pray wayback machine picked up my obscure website.</p><p>I'm not too worried. It's just data on the filesystem, it's not executing programs. And the data is not supposed to contain any secrets. If it ever does then I better rewrite my git history.</p></div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: (Score:1)</h2>
+ <h3>Re: (Score:1)</h3>
<div class='by' style='font-style: italic;'>by Anonymous Coward</div>
<div class='comment_content'><p></p><p>The most likely actual security implication is hard coded keys to 3rd party APIs.</p><p>Not that this is an inevitable threat, itâ(TM)s just something I could see being inadvertently exposed and useful without much additional effort.</p></div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: (Score:1)</h2>
+ <h3>Re: (Score:1)</h3>
<div class='by' style='font-style: italic;'>by Orrin Bloquy ( 898571 )</div>
<div class='comment_content'><p></p><p>> itâ(TM)s</p><p>Clear something up, are you typing curly quotes/apostrophes on purpose or do you have your browser configured to automatically do that.</p></div>
</div>
</div>
<div class='comment' style='display: block; margin-left: 80px'>
- <h2>Re: (Score:2)</h2>
+ <h3>Re: (Score:2)</h3>
<div class='by' style='font-style: italic;'>by jonwil ( 467024 )</div>
<div class='comment_content'><p></p><p>What about if that .git folder (and the website's source code) included private keys for stuff. Or credentials/API keys for 3rd party services. Or credentials for database and other servers.</p></div>
</div>
git://git.nikiroo.be / gofetch.git / blobdiff