Hackers have far an excessive amount of to realize from uncovered Git configuration information. “In some circumstances, if the complete .git listing can also be uncovered, attackers might be able to reconstruct your complete codebase — together with commit historical past, which can include confidential data, credentials, or delicate logic,” researchers mentioned.
Final week, cybersecurity researcher Sharon Brizinov reported accumulating $64,000 in bug bounty winnings for locating dozens of GitHub repositories nonetheless exposing secrets and techniques from deleted information owing to Git’s retention of code modifications and related information even after deletion.
The chain of Web Archive breaches from October 2024 was reportedly carried out utilizing credentials (Gitlab secrets and techniques) stolen in the identical manner. GreyNoise really useful proscribing .git listing entry from public internet servers, blocking entry to hidden information and folders in internet server configurations, checking logs for repeated requests for .git/config, and rotating any credentials uncovered in model management historical past, to remain forward of hackers.
