Having fun with Github

Github has some holes in their basic security which allow some tampering and spoofing. This had and will again help APTs to run campaigns. We will walk through some of them. Most of this has been found by several people before and at least once a year this gets some attention. TL;DR: On Github it is possible to: Spoof Commit authors Spoof Contributors Host hidden payloads under github.com (mostly…