GitHub will revoke three password-protected code-signing certificates for its Desktop and Atom applications on Thursday of this week. GitHub detected unauthorized access to repositories in early December 2022. The revocation will invalidate certain versions of Desktop and Atom as of February 2. Mac users are urged to update to the latest version of Desktop (2.3.1.5 as of this writing). Atom users will need to downgrade to a previous version of that application.
Note
- This is actually an example of the PKI certificate model working. Encrypted signing certs were exfiltrated, no signs that the encryption passwords were compromised. Revocation is being done purely as a preventative measure, meaning time to do updates using standard processes.
- Good move from GitHub to revoke these certificates. But remember that you must update GitHub Desktop and Atom this week.
- The Windows version of Desktop isn’t impacted. Read the guidance carefully, you’re updating Mac versions of Desktop to the latest, while downgrading your Atom installs to 1.60.0 as 1.63.1 and 1.63.0 will stop working. Have a KB article handy, with download links, for when the calls start coming in on Thursday/Friday (and Monday.)
- Code signing is an important security protocol to verify that software is authentic and developed by the vendor. The loss of code signing certificates could allow an adversary to create and distribute malicious versions of the software, where end user organizations simply install the update. Revoking the affected code signing certificates is both prudent and necessary to protect end-users.
- Certificates are public information about asymmetric key pairs. They cannot be “stolen;” they cannot be used to sign code. Code is signed using the private key of the pair resulting in a certificate, containing the public key, which can then be used to authenticate the code. Revoking a certificate is a statement that, for whatever reason, including compromise of the private key, code associated with the key pair may not be authentic and should not be trusted. Private code-signing keys should not be stored online when not in use.
Read more in: Action needed for GitHub Desktop and Atom users
