{"id":5860,"date":"2018-07-10T14:23:00","date_gmt":"2018-07-10T14:23:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/the-aftermath-of-the-gentoo-github-hack\/"},"modified":"2018-07-10T14:23:00","modified_gmt":"2018-07-10T14:23:00","slug":"the-aftermath-of-the-gentoo-github-hack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/the-aftermath-of-the-gentoo-github-hack\/","title":{"rendered":"The aftermath of the Gentoo GitHub hack"},"content":{"rendered":"
<\/div>\n

Gentoo GitHub hack: What happened?<\/h2>\n

Late last month (June 28), the Gentoo GitHub repository was attacked after someone gained control of an admin account. All access to the repositories was soon removed from Gentoo developers. Repository and page content were altered. But within 10 minutes of the attacker gaining access, someone noticed something was going on, 7 minutes later a report was sent, and within 70 minutes the attack was over. Legitimate Gentoo developers were shut out for 5 days while the dust settled and repairs and analysis were completed.<\/p>\n

The attackers also attempted to add “rm -rf” commands to some repositories to cause user data to be recursively removed. As it turns out, this code was unlikely to be run because of technical precautions that were in place, but this wouldn’t have been obvious to the attacker.<\/p>\n