Change Git user in Windows

Problem: How to change Git user in Windows?

Solution:

Step 1: Remove already saved credentials



Go to: Control Panel -> User Accounts -> Manage your credentials -> Windows Credentials

Windows Credential Manager

Under Generic Credentials, there are some credentials related to Github,
Click on them and click "Remove".

Now you will be asked for new credentials next time.

Reason:

Default installation for Git for Windows set a Git-Credential-Manager-for-Windows.

Either avoid checking "Git Credential Manager" checkbox during the Git for Windows installation

or

You can disable Git-Credential-Manager-for-Windows as follows:

Option 1:

Run Git Bash as Administrator and use git config --edit --system to remove the helper = manager  line so that it is no longer registered as a credential helper.

Option 2:

Run Git Bash as Administrator and then execute the following command

git config --system --unset credential.helper

Now you will be asked for credentials every time you interact with the remote system.



[Update]
Friday, 11 January 2019

Today I faced the same problem again as i updated the software "Git for windows"
&
I couldn't remove the credentials manager by any means

I ended up using below command explained in this git issue

git config --global credential.github.com.useHttpPath true

Read More

Quickpost: SteamStealers via Github

Back in 2014, I created a blog post named 'Malware spreading via Steam chat', where I analysed and discussed one of the first 'SteamStealers' - malware that is exclusively targeting gamers, or at least those who use Steam.

You can read that blog post here. Another SteamStealer technique was via a Chrome extension, and there are many others reported as well - if you fancy a read, check out a blog post and paper I co-authored with Santiago here.

This blog is meant as a quick post and heads-up, as some cybercriminals who use SteamStealer, are now also resorting to using Github. I was notified of this by Malwarehunterteam on Twitter:

Also, anyone seen before a malware which replaces Steam trade links?
cc @bartblaze @spontiroli pic.twitter.com/XFcVQKy4On

— MalwareHunterTeam (@malwrhunterteam) January 12, 2018

In this example, Evrial uses Github to copy/steal clipboard contents, and replaces Steam trade offer links. Note that Evrial is a full-blown infostealer.


Another recent example, given to me by advicebanana, is a SteamStealer for the sole purpose of stealing your Steam credentials. In this specific case, the malware was redirected from:
http://screenpicture[.]pro/image293[.]jpg to the following page or Gist, hosted on Github:
https://raw.githubusercontent[.]com/Hamlo22888/Sur/master/image293[.]scr

While the gist is already offline at time of posting, it's possible some Steam users may have been tricked into downloaded and executing the file.

Interesting to note that the debug path in this specific sample is:

D:\asd\php\steam_complex\New_steal\new_steal_no_proxy\14ver -original(pubg+??????????)\SteamStealer\obj\Release\vv.pdb

While in my original blog post, from 2014, it was as follows:

d:\asd\????????_new\??#\add\SteamComplex\SteamStealer\?????????? ?????????? (18)\SteamStealer\obj\Release\vv.pdb

It appears the original SteamStealer developer is still going strong.

For preventing getting scammed or ending up with a SteamStealer on your machine, follow the prevention tips in this blog post.



Conclusion

SteamStealers are (again) alive and well. While there was a drop observed at some point, due to the enormous amount of scamming websites, it appears the SteamStealer malware is back in business.

Github is also getting more popular among cybercriminals - often whitelisted in organisations, it offers yet again another method of hosting malware.

As mentioned before, follow the prevention tips in my earlier blog post to stay safe.


Indicators

Read More