警惕Github钓鱼套路

Security Classification: 【C-1】 | Publish Time:2024-02-22 | Category:Test Notes | Edit
Old Version | Diff |
Expiry Notice: The article was published three months ago. Please independently assess the validity of the technical methods and code mentioned within. :)

AI Summary: 作者发现自己的Github账户可能遭到钓鱼攻击，创建了一个名为backupxxx的仓库，显示账户信息被盗。攻击者通过提交PR并提及用户，发送钓鱼邮件，诱使用户点击链接进行Oauth认证，获取仓库的读写删除权限。邮件以Github招聘名义发出，增加了可信度。作者意识到使用子域名和Oauth方式不正常，因此总结了防范措施：1) 将核心敏感代码私有化；2) 不轻易认证非官网的授权请求；3) 仔细检查Oauth的作用域。 --- (From Model:gpt-4o-mini-2024-07-18)

Comment List
Comment
© Copyright: This article is an original work and the copyright belongs to the  Depy's docs  unless marked as Reproduced

Please contact the blogger for authorization to reprint


『📕Category 』