Thursday, March 28, 2024

Hackers Compromised CircleCI Employee’s Laptop to Breach the Company’s Systems

CircleCI, a DevOps platform, discovered that malware installed on a CircleCI engineer’s laptop was used by an unauthorized third party to steal a legitimate, 2FA-backed SSO session.

On December 16, 2022, this device was compromised. The company’s antivirus programme was unable to detect the malware.

“Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location and then escalate access to a subset of our production systems”, according to the CircleCI incident report.

Reports say the unauthorized third party had access to and was able to exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys because the targeted employee had the authority to generate production access tokens as part of the employee’s regular duties.

On December 19, 2022, the threat actor is suspected to have conducted reconnaissance, which was followed by data exfiltration on December 22, 2022.

In order to potentially gain access to the encrypted data, the third-party extracted the encryption keys from a running process.

Additional Layers of Protection are Implemented

The company stated that additional detection and blocking of the specific behaviors displayed by the malware employed in this assault through MDM and A/V solutions are implemented. They have restricted access to production environments to a very small number of employees. 

Further, the company said implemented more stringent authentication rules and procedures to guard against potential unauthorized production access. A monitoring and alerting system were put in place for the specified behavioral patterns.

The change occurred a little over a week after CircleCI advised its users to rotate all of their secrets. The company said that this was necessary as a result of “suspicious GitHub OAuth behavior” that was reported to them by one of its users on December 29, 2022.

The company said it worked with Atlassian to rotate all Bitbucket tokens, revoked Project API Tokens, and Personal API Tokens, informed customers of potentially affected AWS tokens, and proactively took the step of rotating all GitHub OAuth tokens after learning that the customer’s OAuth token had been compromised.

How Can I Determine Whether Data Is At Risk?

“We recommend you investigate for suspicious activity in your system starting on December 16, 2022, and ending on the date you completed your secrets rotation after our disclosure on January 4, 2023. Anything entered into the system after January 5, 2023, can be considered secure”, says the report

Recommendations

  • Use OIDC tokens wherever possible to avoid storing long-lived credentials in CircleCI.
  • Use IP ranges to restrict inbound connections to just known IP addresses for your systems.
  • Contexts can be used to group shared secrets, limit access to them to certain projects, and cycle them automatically.
  • For privileged access and additional controls, choose to use runners, which allow you to connect the CircleCI platform to your own compute and environments, including IP restrictions and IAM management.

Network Security Checklist – Download Free E-Book

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles