{"id":10521,"date":"2019-02-21T14:55:24","date_gmt":"2019-02-21T22:55:24","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=10521"},"modified":"2024-01-31T03:37:57","modified_gmt":"2024-01-31T11:37:57","slug":"impersonation-and-identity-theft-risk-on-github-and-how-to-prevent-it","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/impersonation-and-identity-theft-risk-on-github-and-how-to-prevent-it\/","title":{"rendered":"Impersonation and Identity Theft Risk on GitHub and How to Prevent It"},"content":{"rendered":"

In today\u2019s world, people who commit fraud, or scammers, frequently attempt to masquerade as another person or entity. Identity theft happens for a multitude of reasons, including but not limited to stealing credit, credentials or currency, or as an attempt to discredit by falsely attributing statements or other content to someone. Unfortunately, verifying someone\u2019s identity and distinguishing truth from lies can be difficult for most people.<\/p>\n

As an example, practically all modern day computer software is to some degree reliant on open source code<\/a> that is hosted and collaborated on GitHub: The world\u2019s largest open source code repository. In a GitHub repository, the full source code for a project is available along with full authorship and history, and GitHub makes efforts to make this information as accessible as possible (such as drawing GitHub user avatars next to any code authored in their name). What many people may not realize is that this information is entirely under the control of the repository owner and can be trivially forged.<\/p>\n

Open source software is supposed to be all about the code rather than the author so this doesn\u2019t seem like a serious problem at first, but in practice most software developers can\u2019t verify all the code all the time, so reputation-based trust becomes a habit. Trust in reputation, or an identity, opens up an attack vector similar to phishing, where people can be tricked into trusting something based on a familiar name.<\/p>\n

A scammer could easily fork a project to a similar repository URL and make additional commits in the name of a credible person, and either try to trick people into using their repository instead of the official one, or they could submit pull requests to other forks or back to the original, hoping that people mistake the additions as coming from a legitimate source. Another possible consequence is that disagreeable content could be committed in someone else\u2019s name in an attempt to hurt their reputation in the developer community. As we\u2019ve seen with SickRage<\/a>, this could definitely lead to issues.<\/p>\n

See Proof of Concept:<\/p>\n

\"\"<\/a>\"\"<\/a><\/p>\n

The good news is that there is a solution for this: Git and GitHub supports cryptographic signatures, making it possible to verify if a commit truly comes from a trusted source. \u00a0The bad news is that very few projects actually make use of this feature. Therefore, we have put together this tutorial for how to set up GPG on your computer and begin signing your email messages and Git commits:<\/p>\n

How to Setup GPG<\/h2>\n
    \n
  1. Download GPG\n