CircleCI, a DevOps platform, discovered that malware installed on a CircleCI engineer’s laptop was used by an unauthorized third party to steal a legitimate, 2FA-backed SSO session.
On December 16, 2022, this device was compromised. The company’s antivirus programme was unable to detect the malware.
“Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location and then escalate access to a subset of our production systems”, according to the CircleCI incident report.
Reports say the unauthorized third party had access to and was able to exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys because the targeted employee had the authority to generate production access tokens as part of the employee’s regular duties.
On December 19, 2022, the threat actor is suspected to have conducted reconnaissance, which was followed by data exfiltration on December 22, 2022.
In order to potentially gain access to the encrypted data, the third-party extracted the encryption keys from a running process.
Additional Layers of Protection are Implemented
The company stated that additional detection and blocking of the specific behaviors displayed by the malware employed in this assault through MDM and A/V solutions are implemented. They have restricted access to production environments to a very small number of employees.
Further, the company said implemented more stringent authentication rules and procedures to guard against potential unauthorized production access. A monitoring and alerting system were put in place for the specified behavioral patterns.
The change occurred a little over a week after CircleCI advised its users to rotate all of their secrets. The company said that this was necessary as a result of “suspicious GitHub OAuth behavior” that was reported to them by one of its users on December 29, 2022.
The company said it worked with Atlassian to rotate all Bitbucket tokens, revoked Project API Tokens, and Personal API Tokens, informed customers of potentially affected AWS tokens, and proactively took the step of rotating all GitHub OAuth tokens after learning that the customer’s OAuth token had been compromised.
How Can I Determine Whether Data Is At Risk?
“We recommend you investigate for suspicious activity in your system starting on December 16, 2022, and ending on the date you completed your secrets rotation after our disclosure on January 4, 2023. Anything entered into the system after January 5, 2023, can be considered secure”, says the report
Recommendations
- Use OIDC tokens wherever possible to avoid storing long-lived credentials in CircleCI.
- Use IP ranges to restrict inbound connections to just known IP addresses for your systems.
- Contexts can be used to group shared secrets, limit access to them to certain projects, and cycle them automatically.
- For privileged access and additional controls, choose to use runners, which allow you to connect the CircleCI platform to your own compute and environments, including IP restrictions and IAM management.
Network Security Checklist – Download Free E-Book