This Week in Security: Microsoft on Microsoft, Register Your Domains, Linux on ARM, and FreeBSD Joins the File Cache Club

Microsoft’s open source Azure repositories were automatically disabled by GitHub after being compromised by the Miasma worm, affecting over 70 repositories in a supply chain attack. Additionally, Microsoft fixed a critical bug allowing GitHub token theft via embedded VS Code, while other security issues emerged involving TP-Link devices, OpenSSL vulnerabilities, and the return of researcher NightmareEclipse with new exploits. These incidents demonstrate persistent threats and ongoing industry efforts to respond.

On Tuesday, OpenSourceMalware reported that 73 Microsoft-related repositories on GitHub were flagged and taken offline within minutes after being infected by the Miasma worm, which exploited the Microsoft Durabletask package. The attack appears to have stemmed from previous compromises of the package, which was used to push infected code and steal credentials. Microsoft responded by disabling the repositories to contain the spread, though this disrupted build processes relying on those packages.

In a separate development, Microsoft addressed a critical bug in GitHub’s embedded web-based VS Code editor, discovered by Ammar Askar. The flaw could allow malicious actors to steal user authentication tokens by manipulating the sandboxed environment to install malicious extensions. Microsoft issued a fix, emphasizing the importance of securing developer environments against such exploits.

Julian B demonstrated how unregistered domain names embedded in TP-Link router firmware could be exploited. After analyzing firmware releases, Julian registered a domain that TP-Link devices checked into, revealing potential security risks. The domain has since been transferred back to TP-Link, but the incident underscores risks associated with unregistered domains in IoT device firmware.

OpenSSL revealed a new set of vulnerabilities, including a high-severity use-after-free flaw in PKCS7 handling that could allow remote code execution. While most applications are unlikely to be directly impacted, the advisory urges prompt updates to affected software to mitigate potential exploits.

Researcher NightmareEclipse, known for releasing advanced Windows vulnerabilities, has returned under the alias MSNightmare. The researcher released exploits targeting Windows Defender race conditions and a BitLocker bypass, coinciding with Microsoft’s Patch Tuesday. Microsoft initially threatened legal action but appeared to backtrack, reflecting ongoing tensions over vulnerability disclosures.

Impact of Supply Chain Attacks on Microsoft Repositories

The compromise of Microsoft’s open source repositories highlights the growing threat of supply chain attacks, which can disrupt development pipelines and expose organizations to credential theft and malware. The incident underscores the importance of proactive security measures and rapid response to contain such breaches, especially given the widespread use of affected packages like Durabletask.

This week’s events demonstrate that even major tech companies remain vulnerable to sophisticated supply chain exploits, emphasizing the need for continuous monitoring, secure coding practices, and swift incident response to protect critical infrastructure and developer ecosystems.

Recent Trends in Security Breaches and Exploits

Supply chain attacks have surged over the past year, with notable incidents targeting open source repositories, IoT devices, and widely used libraries like OpenSSL. Microsoft’s repositories have previously been targeted, and this week’s attack marks a significant escalation. Meanwhile, vulnerabilities in widely adopted libraries and tools—such as OpenSSL—continue to pose risks, while researchers like NightmareEclipse push the boundaries of exploit development, often sparking industry debate over responsible disclosure.

Microsoft’s initial response to vulnerability research has faced criticism, reflecting ongoing tensions between security researchers and vendors. The return of NightmareEclipse after a public threat underscores the complex dynamics of vulnerability disclosure and the importance of fostering collaborative security efforts.

“The attack on Microsoft repositories illustrates the persistent threat of supply chain compromise, which can have cascading effects across multiple organizations.”

— OpenSourceMalware

Unresolved Questions and Ongoing Investigations

It is not yet clear how extensive the impact of the Microsoft supply chain attack will be, including whether other packages or repositories are compromised. The full scope of the TP-Link domain issue and potential risks to devices remains uncertain, as does the long-term effect of the OpenSSL vulnerabilities. Additionally, Microsoft’s internal response to the return of NightmareEclipse and the potential legal or policy changes are still developing.

Next Steps in Security Response and Industry Trends

Microsoft is expected to continue investigating the supply chain attack, with updates on affected packages and mitigation strategies. Organizations should monitor for further disclosures on the scope of the compromise and apply recommended security patches promptly. The security community will likely scrutinize the OpenSSL vulnerabilities and the exploits released by NightmareEclipse, with vendors releasing patches ahead of the next Patch Tuesday. Additionally, IoT vendors like TP-Link may implement stricter domain management and firmware security measures to prevent similar issues.

Key Questions

How serious is the Microsoft supply chain attack?

The attack compromised over 70 repositories, including critical packages like Durabletask, which could impact development and deployment pipelines. While Microsoft responded quickly, the full extent of the damage or any lingering malicious activity remains under investigation.

What should developers do about the GitHub token vulnerability?

Microsoft has issued a fix for the bug allowing token theft via embedded VS Code. Developers should update their GitHub environments and review security practices to prevent token exfiltration.

Are TP-Link devices at risk from the unregistered domain issue?

The discovery shows potential risks related to unregistered domains in firmware. While immediate threats are unclear, device manufacturers should review firmware security and domain management practices.

How urgent are the OpenSSL vulnerabilities?

OpenSSL has issued advisories for multiple vulnerabilities, including a high-severity use-after-free bug. Users should update affected software as soon as patches are available to mitigate potential remote code execution risks.

What does the return of NightmareEclipse mean for Windows security?

The researcher’s exploits highlight ongoing vulnerabilities in Windows Defender and BitLocker. Microsoft is expected to address these in upcoming patches, but the exploits underscore the importance of proactive security measures.

Source: Hackaday