Title: TL;DR — A user named haxorlife took over 65 domains today, by exploiting a security flaw in the custom domain configuration in GitHub Pages.<p>Earlier today, my GitHub Pro subscription expired. I let it expire, because a month ago, I decided to downgrade to the Free plan. I downgraded because a month ago, GitHub announced that Free plans would have unlimited private repositories. However, there was a detail I didn&#x27;t catch. On the Free plan, you can have Pages on a public repo, or a private repo without Pages. But you can’t have Pages on a private repo. So what happened when my plan downgraded this morning? My GitHub Pages configurations got quietly deleted. No warning was given. My websites just disappeared. I only learned about it with an alert from Keybase.<p>In the time between my sites getting deleted, and my discovery, a GitHub user by the name of haxorlife created a repository at https:&#x2F;&#x2F;github.com&#x2F;haxorlife&#x2F;iosref.com, named after one of my affected domain names, iosref.com. And they configured iosref.com as the custom domain for that repo. So when I went to my website, I was suddenly faced with &quot;pwned by FA Haxor [!]&quot;.<p>It turns out that GitHub doesn&#x27;t require proof of ownership in order to set a custom domain. (Other services like Gitlab require proof via a TXT DNS record.) Worse yet, if I try to re-add my own domain to my repository, I&#x27;m shown the error: &quot;The CNAME iosref.com is already taken.&quot; And the support page only says: &quot;If you don&#x27;t own the repository that contains the CNAME file with your custom domain, try to contact the owner and ask them to update their custom domain.&quot;<p>There are 65 repositories owned by haxorlife with identical contents, which means that up to 65 domains are affected by this one user. I personally deleted my GitHub-related DNS records for my domain, and later moved my site to DigitalOcean. If you have an affected domain, I urge you to do the same. I contacted GitHub support four hours ago, but haven&#x27;t heard back yet.
Upvote: