Serhiy Kolyada on Rassia’s preparations for a new offensive.

GitHub confirmed that threat actors exfiltrated encrypted code signing certificates for some versions of GitHub Desktop for Mac and Atom apps.

GitHub this week disclosed a security breach, threat actors exfiltrated encrypted code signing certificates for some versions of GitHub Desktop for Mac and Atom apps.

In response to the incident, the Microsoft-owned company is started revoking the exposed certificates.

The following versions of GitHub Desktop for Mac will stop working on February 2, 2023: 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.1.0, 3.1.1, and 3.1.2. Similarly, Atom versions 1.63.0 and 1.63.1 will stop working on February 2, in this case users are urged to download a previous Atom version, because Atom was discontinued in December 2022.

The company pointed out that customer data was not impacted because they were not stored in the impacted repositories.

“On December 6, 2022, repositories from our atom, desktop, and other deprecated GitHub-owned organizations were cloned by a compromised Personal Access Token (PAT) associated with a machine account.” reads the notice published by GitHub. “Once detected on December 7, 2022, our team immediately revoked the compromised credentials and began investigating potential impact to customers and internal systems.”

If threat actors will be able to decrypt the code signing certificates they can use them to sign malicious. The signed malicious code will evade detection because it will appear as developed by GitHub.

The company states that it has no evidence that the threat actor was able to decrypt or use these certificates.

The three compromised certificates that will be revoked on February 2, 2023, are two Digicert code signing certificates used for Windows and one Apple Developer ID certificate.

The company states that the security breach has no impact on GitHub.com or any of its other services.

“On Thursday, February 2, 2023, we will revoke the Mac & Windows signing certificates used to sign Desktop app versions 3.0.2-3.1.2 and Atom versions 1.63.0-1.63.1. Once revoked, all versions signed with these certificates will no longer function. We highly recommend updating Desktop and/or downgrading Atom before February 2 to avoid disruptions in your workflows.” concludes the notice.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, code signing certificates)

The post GitHub to revoke stolen code signing certificates for GitHub Desktop and Atom appeared first on Security Affairs.

Rep. George Santos leaves a GOP caucus meeting on Capitol Hill on January 25, 2023.

Anna Moneymaker/Getty Images

Rep. George Santos of New York on Tuesday told his fellow Republican colleagues during a conference meeting that he will step down from his committee assignments, three people familiar with the situation told CNN’s Manu Raju.

The decision comes as the embattled congressman has been mired in scandal after he fabricated parts of his resume. Santos was set to serve on the House Science, Space and Technology Committee and House Small Business Committee.

This story is developing. Please check back for updates.

 

Employees at Sheetz’s roughly 650 convenience stores must have full smiles without any “missing, broken, or badly discolored teeth,” according to company policy.

Ben Hasty/MediaNews Group/Reading Eagle via Getty Images

• A former Sheetz employee said she quit over the chain’s “smile policy.”
• Another employee said a manager referenced the policy during a promotion discussion.
• Sheetz is reviewing the policy following a previous Insider inquiry about the rule.

At the start of 2023, Rose found herself in a discussion with a manager at a Sheetz store in Ohio where she worked. The topic: her teeth.

Rose said she had lost several of her teeth years earlier as a result of domestic abuse by an ex-spouse. Now, she was asking for time off to have dental work done to construct a new denture.

But Rose wasn’t just getting the work done for her own sake, she said. A Sheetz company policy forbids employees from working with “obvious missing, broken, or badly discolored teeth” unrelated to a disability and gives them 90 days to fix the issue. Rose said the manager asked her for a detailed timeline showing when the procedures would take place and how much they would cost.

Rather than provide those details, Rose quit. “At that point, to be honest, I didn’t want to be there anymore,” she told Insider. Rose asked that Insider not use her full name due to potential professional consequences.

Sheetz told Insider that the manager was “newly promoted” and “was handling this type of situation for the first time.”

“As a result, this employee was provided inaccurate information which our HR team has since resolved by speaking with this employee directly earlier this week,” Sheetz PR Manager Nick Ruffner told Insider in a statement on Friday. Sheetz also told Insider that it asked for a detailed treatment plan “to determine which of our assistance programs may apply to the situation.”

Insider spoke with three former employees with knowledge of Sheetz’s teeth policy. The policy applies to current employees, and also prohibits hiring workers with visible dental issues. Sheetz said it would review the policy following an Insider inquiry earlier this month.

Some workers said the policy was unevenly enforced. Rose told Insider that a different manager who hired her had forgotten about the rule until she asked for time off. “He said, ‘technically, I should’ve never hired you in the first place,'” Rose said.

One employee said a manager referenced the ‘smile policy’ during a promotion discussion

Some Sheetz employees refer to the chain’s rule about teeth as the “smile policy.”

“They wanted you to smile whenever somebody walked in the door,” said one former employee who worked in a Sheetz store in New York state. The rule even applied early in the pandemic, when employees and customers wore face masks, said the employee, who asked to remain anonymous because they feared damaging their job prospects. Insider verified their identity and employment.

Managers have in some cases hired workers who technically violated the rule, however, workers told Insider. 

“Sheetz culture does vary widely by store,” said a former employee who worked at one of the company’s North Carolina stores until last year. “The store manager is a big part of the individual store culture.” 

While they were working at Sheetz, the employee developed tooth discoloration as a side effect of another medical condition. They said they put off trips to the dentist due to cost. “Dental work is really expensive, even on Sheetz’s really good dental plan,” said the employee, who did not want to be identified, citing potential effects on their professional reputation. Insider verified their identity and employment.

The employee said that when they expressed interest in a supervisor position, their manager told them that their teeth would be a problem for the store’s district manager. “My manager said ‘they would absolutely enforce that policy on you,'” the person said. They decided not to pursue the promotion, and later quit.

Sheetz said it offers dental insurance through United Healthcare’s Concordia Elite Plus plan. The deductible-free insurance covers the full costs of simple procedures, such as exams, cleanings, and some extractions. It covers half the cost of more complicated procedures, such as crowns, inlays, and denture repair, Sheetz told Insider.

Sheetz has won recognition for its treatment of workers

Sheetz’s smile requirement stands out as as unusually draconian, the former employee in North Carolina said, since many of the chain’s benefits and policies are better than similar retail jobs.

In 2021, for instance, Sheetz started offering employees who gave birth 12 weeks of fully paid leave. Previously, employees received six weeks of partially paid time off and six weeks off without pay. The same year, the company also increased its annual college tuition reimbursement amount to $5,250, up from $1,500, Sheetz told Insider.

The company has also earned awards for its treatment of workers. Last year, Fortune ranked Sheetz third on its list of Best Workplaces in Retail, behind Target and the grocery chain Wegmans.

Steve Rowland, a former retail manager who hosts the Retail Warzone podcast, said he wasn’t aware of another retailer that had a similar policy about employees’ teeth.

“That’s extremely specific and extremely ballsy to put that in writing,” Rowland said.

Sheetz’s smile requirement stands out among retailers because some people affected have tooth problems beyond their control, such as accidents or medical side-effects, the ex-employees told Insider.

“It honestly to me is one of the more surprising policies they have,” the former employee in North Carolina said of Sheetz’s smile requirement. “It feels weirdly over the top for them.”

• Four friends spent more than a decade designing a machine that recycles plastic waste.
• The Polyfloss machine spins plastic into thin fibers that can be used for insulation. 
• The company plans on deploying the machine globally to reduce trash and help keep shelters warm.

Inspired by cotton candy, four friends spent more than a decade designing a machine that turns locally sourced plastic waste into thin fibers that can be used for insulation. They plan on deploying their product around the world to reduce trash and help keep even the most basic shelters warm.

Ukraine hopes to secure widespread international support for banning Russian and Belarusian athletes from the Paris Olympics due to Moscow’s invasion, the sports minister said on Tuesday.

The International Olympic Committee (IOC) is open to including Russian and Belarusian athletes as neutrals at the 2024 Games and has opened a door to them competing in qualifiers.

“This is unacceptable for us,” Sports Minister and former Olympic champion Vadym Huttsait told Reuters at his offices in Kyiv, beside a wall with portraits of athletes killed in the war launched by Moscow a year ago with assistance from Belarus.

“It is impossible for us at a time when the full-scale war is going on, when our athletes, our soldiers are defending our homeland, our land, defending their homes, their families, their parents.”

The 51-year-old won an Olympic fencing team gold in 1992, was junior sabre champion in the old Soviet Union four years before that, and coached Ukraine’s winning team at the 2008 Games.

At least 220 Ukrainian athletes and coaches have died in the war, Huttsait said, with over 340 sports facilities damaged or ruined.

“Ukraine will unite with many countries in Europe and the world … and it (Russians competing) will not be allowed,” he added, saying 40 nations had given Ukrainian athletes housing and training assistance abroad during the war.

However, there has been little public support yet from other nations for an outright ban on Russians at Paris.

Moscow says its “special military operation” in Ukraine is to protect its own security, denies accusations of atrocities, and says any push to squeeze it out of global sport will fail.

The IOC’s previous recommendation to ban Russians and Belarusians has been applied by many sports federations.

But last week, it backed a proposal by the Olympic Council of Asia to allow them to compete in Asia, which could potentially include Olympic qualifying events.

Should that happen, Ukraine’s sporting authorities and athletes will face a “very difficult decision” whether to boycott Paris, Huttsait said.

“When we lose so many people, so many athletes, the lives of Ukrainians are more important to us than any medal at international competitions,” he said.

Ukrainian officials have turned on the IOC in recent days for promoting “violence, mass murders, destruction” with the idea of giving Russia a “platform to promote genocide.”

The IOC has called that defamatory and said such words do not promote constructive discussion.

On Tuesday, ex-boxing champion Wladimir Klitschko, brother of Kyiv’s mayor, called on IOC head Thomas Bach not to betray the Olympic spirit and become an “accomplice in this abominable war” by letting Russia compete.

Moscow is trying to turn the page on years of doping scandals after its teams were forced to compete without their flag or anthem at the Olympics and major international events.

---

The White House said Tuesday that President Joe Biden will put forth his proposed U.S. spending plan on March 9, setting a deadline ahead of his meeting with the U.S. House’s Republican leader on Wednesday to discuss the nation’s spending.

Biden will call on House of Representatives Speaker Kevin McCarthy during their White House meeting to commit to release a budget plan as well and to pledge to meet the nation’s debt obligations, according to a White House memo seen by Reuters.

McCarthy and his fellow conservatives, who narrowly won control of the House last November, are threatening to block a regular increase of the nation’s debt limit unless Biden pledges lower spending; Biden has said any negotiation on previously approved U.S. spending was a non-starter.

Republicans have not yet agreed on how fiscal spending should be trimmed, or firmed up the parameters of a 2023 budget. The White House has seized on the lack of consensus to highlight fringe proposals from some Republicans, including one that abolishes the Internal Revenue Service in favor of a higher sales tax and one that trims the Social Security retirement plan.

Asked what his message will be for McCarthy, Biden told reporters on Monday: “Show me your budget, I’ll show you mine.”

While the president can propose a budget plan, both houses of Congress must pass any spending legislation. Biden’s fellow Democrats narrowly control the Senate, where spending bills need 60 votes to pass. The House needs a simple majority to pass these bills; McCarthy has ruled out cuts to Social Security and Medicare, the two largest benefit programs.

The showdown over the growing U.S. debt threatens to roil the global economy if the United States defaults. U.S. Treasury Secretary Janet Yellen has said the country may reach its debt limit as soon as June and has called on Congress to take swift action.

The Treasury Department has already started taking “extraordinary measures” to stave off a default until summer after hitting the U.S. government’s $31.4 trillion borrowing limit earlier in January.

On Wednesday, Biden plans to ask McCarthy if he will “commit to the bedrock principle that the United States will never default on its financial obligations” and if he agrees “that it is critical to avoid debt brinksmanship.”

“I want to find a reasonable and a responsible way that we can lift the debt ceiling, but take control of this runaway spending,” McCarthy, who could not be immediately reached for comment, told CBS News on Sunday.

“I want to sit down together, work out an agreement that we can move forward, to put us on a path to balance – at the same time, not put any … of our debt in jeopardy.”

Related Galleries:

Budweiser is aiming to appeal to younger beer drinkers with a Super Bowl commercial that features actor Kevin Bacon and hip hop record producer Metro Boomin, and brings back the beer brand’s classic tagline, “This Bud’s for you.”

The commercial, which will air during the National Football League’s championship game between the Philadelphia Eagles and Kansas City Chiefs on Feb. 12, comes as younger drinkers have embraced craft beers and hard seltzers, which have boomed in popularity in recent years.

The new ad shows six real everyday Americans, including a construction worker, a food truck owner and a basketball player enjoying a Bud as they unwind or pursue their passions. Each person takes a beer and passes the six-pack to the next until the final beer is handed to the viewer.

“They say all people are six degrees of separation away from each other, but some are just a six-pack away,” says Bacon, who narrates the commercial. It is a not so sly reference to the parlor game “Six Degrees of Kevin Bacon” – a takeoff on the play “Six Degrees of Separation” – in which every actor in Hollywood can supposedly be connected to Bacon through six or fewer movies.

Budweiser resurrected the tagline “This Bud’s for you” by showcasing real people who embody qualities such as grit and determination, said Kristina Punwani, head of marketing for Budweiser USA.

“The tagline came out in 1979 and showed a Bud was a reward after a hard day’s work,” she said. “We realized the tagline was just as relevant today.”

Metro Boomin, who is from St. Louis, Missouri, where Budweiser parent company Anheuser-Busch (ABI.BR) is based, takes the fourth beer in the ad while in a music studio.

Budweiser will utilize hip hop and music throughout the year as it focuses on younger consumers, Punwani said.

Related Galleries: