How Secure Is Git?
Nearly every developer uses Git development at some point or another. It’s the default at most universities. It’s open source and widely available for anyone to use. And there’s a lot that Git is great for, especially if you’re working on a small project.
But, Git has its drawbacks. Especially when it comes to security.
Is Git Secure?
Native Git is not secure.
By secure, we mean free from danger or threats, whether it’s:
- An outside attack (e.g., a hack).
- An internal threat (e.g., developer carelessness).
Here are the main reasons why Git is not secure:
There are no authentication or verification measures. You can only control Git with server access. And developers can easily rewrite your change history. Since Git is distributed, everyone winds up with a copy of the repository on their laptop. And they can do whatever they want with it.
Is There Git Access Control?
Git access control is lacking in native Git.
There are Git security tools that you can add on. Some of these give you Git access control options. For instance, using Git code hosting tools add layers of security. Popular Git code hosting tools include GitHub, GitLab, Bitbucket, or Helix TeamHub. Safeguards within these tools — such as user authentication — help protect your repositories and manage access.
Other tools give you encryption features — such as git-secret, which encrypts files in a Git repository.
Even if you use these tools, you could still be exposed to risk.
Unless You Lock Down Git
In our recent white paper, we share how you can truly secure Git.
Recent GitHub Security Breaches
Security breaches always make headlines. And GitHub security breaches are no exception. In the last few months alone, there have been a handful of Git security incidents.
4 Recent GitHub Security Breaches
In October 2019, Starbucks developers left an API key in a public GitHub repo. This vulnerability was discovered through a bug bounty platform — and Starbucks paid a bounty to remediate it.
In September 2019, CircleCI announced a security breach. This breach exposed customer login information on both GitHub and Bitbucket Git repositories. CircleCI is now evaluating two-factor authentication measures to prevent a future breach.
In August 2019, GitHub was called out in a lawsuit following the Capital One breach. The reason? Allowing social security numbers to be stored in a Git repository. The lawsuit also cited the public GitHub repository “Awesome Hacking” for encouraging bad behavior.
(Although, it should be noted that “Awesome Hacking” is a public repository owned by an individual. It is not affiliated with GitHub staff or management. There are some major problems with having public repositories — access control being at the top of the list. In some ways, public repositories are like the wild west. Anyone can post anything.)
In May 2019, hackers began wiping Git repositories and replacing them with ransom demands. Those affected were told to pay up or risk the hackers releasing the code. Hundreds of developers on GitHub, GitLab, and Bitbucket were affected. However, developers were encouraged to contact GitHub, GitLab, and Bitbucket support teams to recover their repositories (instead of rewarding the hackers).
In January 2021, a misconfigured Git server at Nissan North America lead to the leak of the source code of the company's mobile apps and internal tools. A Git server was left publicly exposed with a default username and password of admin/admin. The server was taken down while Nissan investigated the improper disclosure of confidential information and source code.
Why Do Hackers Target GitHub?
Hackers target GitHub (and other popular Git hosting tools) for many reasons. But the biggest is the potential they see in hacking into repositories on GitHub and stealing (and potentially selling) intellectual property.
Hardworking developers from companies all over the world use GitHub for personal and business needs, often on an ad hoc basis. And developers in the heat of battle can often overlook security concerns. Hackers know this — and exploit it.
Other Common Git Security Issues
Native Git lacks security features. Git hosting solutions can only do so much. And as a result, there are many Git security issues that you need to be prepared for.
Here are a few of the most common Git issues when it comes to security.
Insecure Directories (.git/config)
Hackers use URLs containing the git directory (e.g., [company].git/config) to access the metadata within a Git repository. Metadata often includes user login information (such as passwords) or customer data information. And hackers can then use that information to plan an attack.
Many security breaches are the result of hackers stealing passwords. These breaches can be avoided by strengthening security measures, such as using two-factor authentication (2FA).
Git Vulnerabilities
Git vulnerabilities can also leave repositories exposed to hackers. For instance, CVE-2018-11235 is a well-documented Git vulnerability. This vulnerability allows for random code execution when a user operates in a malicious repository. (And this is just 1 of 9 currently documented Git vulnerabilities, too.)
In the case of CVE-2018-11235, Git hosting providers (such as GitHub) acted fast. They deployed patches to prevent hackers from taking advantage of this vulnerability.
December 2019 Git Vulnerabilities
Git vulnerabilities continue to be discovered. And they're just going to keep happening. Git hosting providers do address them through patches. For example, in December 2019, GitHub released additional security patches to address several Git vulnerabilities on Windows.
But, if security is important for your organization, you might want to consider alternatives to secure your assets.
Self-Hosted Git Servers
A self-hosted Git server can be a security nightmare. You have to do all the heavy lifting of securing the Git server and granting user permissions. If you don’t know what you’re doing, you’ll leave the door open to attacks.
Plus, you need to conduct backups regularly to ensure you can recover your data, should it be attacked.
Go Beyond Git Security Best Practices
Learn How to Truly Secure Git
It’s difficult to secure Git. Especially if you use native Git. And even if you add Git hosting tools or follow Git security best practices, these Git issues still persist.
To truly secure Git, you need to do more. In our white paper, How to Lock Down Git, you’ll learn how to truly secure Git and protect your company’s IP.