CI services expose company secrets including Github access tokens

guest · May 28, 2019

CI services expose company secrets including Github access tokens
CI build logs continue to expose company secrets
Team of researchers finds GitHub access tokens for various companies inside Travis CI build logs
May 28, 2019
https://www.zdnet.com/article/ci-build-logs-continue-to-expose-company-secrets/

Security researchers are still finding secrets hidden deep inside continuous integration services, years after the issue become common knowledge.

Continuous integration (CI) [...] The purpose of CI is to find bugs as early as possible in the coding process and detect them before they're too deeply embedded into the rest of the project, at which point it may require extensive rewrites.
During the build process, interactions with various remote servers and APIs is necessary, and passwords, SSH keys, or API tokens can be used -- and inherently remain recorded in Travis CI logs.
AN OLD PROBLEM, NEW AGAIN
A few years back, security researchers realized that they could comb Travis CI logs for API keys and other secrets, and report these issues to companies to receive bug bounties.
"Overall, the most impactful findings were predominately GitHub access token leaks," researchers said. They now urge companies to review CI build logs for any sensitive tokens that may slip through Travis CI's basic pattern filtering procedures.
Click to expand...

Log in or Sign up

CI services expose company secrets including Github access tokens

guest Guest

Log in or Sign up

CI services expose company secrets including Github access tokens

guest Guest

Useful Searches