Abuse: fraudulent attribution of commits

[michael_ernst]

At [REDACTED] there are commits that are attributed to me, Michael Ernst.  I did not create those commits, even though they are attributed to me.  I don't know anything about them.  There have been malware commits attributed to me on GitHub in the same timeframe.  Could you please remove those commits and/or remove the repository and/or remove the user who created the repository?

Thank you for your help.

Michael Ernst

[Ben · Accepted solution]

Hi @michael_ernst 

I can see that this is a public repository - and the commits appear to be made from your university email address (when viewing the raw commit).

You were never a member of this workspace according to its audit log, so there's a chance that a user has made use of a leaked AppPassword/SSH key or similar belonging to your account to authenticate as your username, or your email has been used in local git config.

As a first step, I'd suggest securing your account with 2FA and revoking any AppPasswords/SSH Keys from Personal Settings > App Passwords and Personal Settings > SSH Keys respectively.

Unfortunately, since those commits were made more than 30 days ago, we don't have audit logging available that would reveal their method of creation (our max retention period is 30 days).

I've reached out to our security team for further comment regarding the potential disabling of content.

Cheers!

- Ben (Bitbucket Cloud Support)

[Ben]

Hi @michael_ernst 

After further discussion with our security team. A more likely scenario is that someone has your email configured as their local username.

This is a problem with DVCS platforms such as GIT - if their git config contains your email address, GIT will record this as the commit author and Bitbucket will map the email to an existing user account (which is why you're seeing your user account in the commit history). Based on your query - it looks like GitHub has the same behaviour.

We have an article that explains this in more detail below - and a feature request to improve upon this behaviour:

• https://confluence.atlassian.com/bbkb/why-does-the-wrong-username-show-in-my-commit-messages-1168845102.html
• https://jira.atlassian.com/browse/BCLOUD-14663

Unfortunately,  we can't delete/disable the content you've linked as it has been reviewed and does not contain malicious code.

Please let me know if I can provide further clarification.

Cheers!

- Ben (Bitbucket Cloud Support)

[michael_ernst]

> A more likely scenario is that someone has your email configured as their local username.

This was my suspicion.

Thank you for your response.  I appreciate it, though I'm disappointed that the content will remain.