GitHub revealed on Monday that unknown hackers managed to steal encrypted code signing certificates related to some versions of GitHub Desktop for Mac and Atom apps. As a precaution, the company is revoking the exposed certificates. Versions 1.63.0 and 1.63.1 of Atom will stop working on February 2, 2023, and users will need to downgrade to a previous version. On December 7, 2022, GitHub detected unauthorized access to a set of outdated repositories used in the development of GitHub Desktop and Atom. The repositories were cloned a day before with a compromised personal access token linked to a machine account. None of the repositories contained customer data, and the compromised credentials have since been revoked. The repositories contained several encrypted code signing certificates used for Actions in GitHub Desktop and Atom release workflows, according to Alexis Wales from GitHub. There is no evidence that the hackers were able to decrypt or use the certificates. If the certificates were decrypted, the hackers could sign malicious applications with the certificates and make them appear as if they were from GitHub. The three compromised certificates - two Digicert code signing certificates for Windows and one Apple Developer ID certificate - will be revoked on February 2, 2023. GitHub also released a new version of the Desktop app on January 4, 2023, which is signed with new certificates that were not exposed to the hackers. The company also stated that no unauthorized changes were made to the code in the repositories.
This Cyber News was published on thehackernews.com. Publication date: Tue, 31 Jan 2023 04:30:03 +0000