CircleCI says hackers stole encryption keys and customers’ secrets

guest · Jan 15, 2023

CircleCI warns customers to rotate ‘any and all secrets’ after hack
By Carly Page @carlypage_ - January 5, 2023

CircleCI, a company whose development products are popular with software engineers, has urged users to rotate their secrets following a breach of the company’s systems.
Click to expand...

The San Francisco-headquartered DevOps company said in an advisory published late Wednesday it is currently investigating the security incident — its most recent in recent years.

“We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing,” CircleCI CTO Rob Zuber. “At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative measures to protect your data as well.”
Click to expand...

CircleCI, which claims its technology is used by more than a million software engineers, is advising users to rotate “any and all secrets” stored in CircleCI, including those stored in project environment variables or in contexts. Secrets are passwords or private keys that are used to connect and authenticate servers together.

For projects using API tokens, CircleCI said it has invalidated these tokens and users will be required to replace them.
Click to expand...

In 2019, CircleCI was hit by a data breach after a third-party vendor was compromised. This saw hackers compromise user data including usernames and email addresses, usernames and email addresses associated with GitHub and Bitbucket, along with user IP addresses.

In November, CircleCI said that it had also witnessed an increasing number of phishing attempts whereby unauthorized actors were impersonating CircleCI to gain access to users’ code repositories on GitHub.
Click to expand...

guest · Jan 14, 2023

Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident
By Ravie Lakshmanan - January 14, 2023

DevOps platform CircleCI on Friday disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data last month.
Click to expand...

The CI/CD service CircleCI said the "sophisticated attack" took place on December 16, 2022, and that the malware went undetected by its antivirus software.

"The malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location and then escalate access to a subset of our production systems," Rob Zuber, CircleCI's chief technology officer, said in an incident report.
Further analysis of the security lapse revealed that the unauthorized third-party pilfered data from a subset of its databases by abusing the elevated permissions granted to the targeted employee. This included customer environment variables, tokens, and keys.
Click to expand...

The development comes a little over a week after CircleCI urged its customers to rotate all their secrets, which it said was necessitated after it was alerted to "suspicious GitHub OAuth activity" by one of its customers on December 29, 2022.
Click to expand...

guest · Jan 16, 2023

Datadog rotates RPM signing key exposed in CircleCI hack
By Sergiu Gatlan @serghei - January 16, 2023

Cloud security firm Datadog says that one of its RPM GPG signing keys and its passphrase have been exposed during a recent CircleCI security breach.
Click to expand...

However, the company added that it has yet to find evidence that this key was leaked or misused.

"As of January 16th, 2023, Datadog has no indication that the key was actually leaked or misused, but we are still taking the following actions out of an abundance of caution," Datadog said.
In response to CircleCI's disclosure that the threat actor stole customers' environment variables, tokens, and keys from its databases, Datadog has released a new version of its Agent 5 RPM for CentOS/RHEL, signed with a new key.
Click to expand...

Datadog repos not compromised
Datadog added that even if the attacker managed to steal the signing key and would craft a malicious RPM package, they wouldn't be able to use it to target the company's customers because they would also need access to the official package repositories.

"Official Datadog repositories were not compromised. The signing key, if actually leaked, could be used to construct an RPM package that looks like it is from Datadog but it would not be enough to place such a package in our official package repositories," Datadog said.
Customers are advised to ensure that their systems stop trusting the affected key and, if they still do, to delete the key and verify if all installed were built by Datadog using the instructions available here.
Click to expand...

Datadog's disclosure comes after CircleCI revealed on Friday that its systems were breached via an engineer's malware-infected laptop.
Click to expand...

guest · Jan 18, 2023

Squaring the CircleCI: DevOps platform publishes post-mortem on recent breach
By John Leyden @jleyden - January 16, 2023

Popular DevOps platform CircleCI has blamed an attack that successfully planted malware on an internal engineer’s laptop for a recent security breach.
Click to expand...

The attack, acknowledged on January 4, prompted CircleCI to advise software developers that relied on its platform to rotate secrets and API tokens.

In a post-mortem on the breach, published on Friday (January 13), the San Francisco-based company offered a detailed description of what went wrong.
In the wake of the attack, CircleCI has worked with external incident response experts alongside rolling out a suite of measures designed to harden the security of its platform and help its customers to better secure any secrets.
Click to expand...

CircleCI’s writeup goes on to sketch out the tactics and techniques of its attackers alongside the publication of indications of compromise (IOCs), data that will help security defenders at other companies in both identifying and blocking similar attacks.

Although some in the security community faulted CircleCI for failing to follow best practice, particular in a failure to apply adequate access controls to production systems, others praised its “transparent and detailed incident disclosure” and the overall response to the post-mortem from infosec Twitter was positive.
Click to expand...

guest · Jan 19, 2023

Lessons to Learn From CircleCI's Breach Investigation
Beware: Malware Bypassed Antivirus; Attackers Reused Stolen Single Sign-On Tokens
By Mathew J. Schwartz @euroinfosec - January 19, 2023

CircleCI's misfortune to be on the receiving end of an attack that infected an employee's laptop with malware and bypassed two-factor authentication defenses are potential industrywide lessons learned - at least for any company wise enough to learn from another's experience.
Click to expand...

CircleCI is a juicy target. Its continuous integration and continuous delivery platform is used by over 1 million developers, including those at such organizations as Airbnb, Google, Meta, Okta and Salesforce.

The incident is notable as yet another case in which attackers have bypassed two-factor authentication defenses via technical trickery or social engineering
Details of the attack consequently are worth studying for what they reveal about attackers' tools and tactics and as a goad to ensure that your own house is in order.
Click to expand...

While stolen customer data was being stored in encrypted format, the attacker "extracted encryption keys from a running process, enabling them to potentially access the encrypted data," Zuber says.
The company doesn't know how many customers may have been affected.

As of last week, however, he says no more than four customers have reported "unauthorized access to third-party systems as a result of this incident."
Click to expand...

Lessons Learned
Several notable details stand out about the particulars of this attack: [...]
Ideally, no company would ever fall victim to a breach, and especially one that imperils customer or consumer data. But in the real world, criminals are working overtime to secure the opposite result.
Click to expand...

Log in or Sign up

CircleCI says hackers stole encryption keys and customers’ secrets

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

CircleCI says hackers stole encryption keys and customers’ secrets

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches