3 ms·
It would be interesting to see what the compromised version of the bash script did, and how, more specifically. Software supply chain attacks seem to become mo
by filleokus 6y ago
It would be interesting to see what the compromised version of the bash script did, and how, more specifically.
Software supply chain attacks seem to become more common. I guess it's no surprise, considering how powerful an attack vector it is.
- londons_explore 6y agoAn advanced attack would fetch more code from a remote server, and that extra code would be client specific. It would probably just open up a reverse shell or something like that so the attackers server can do whatever it likes and its much harder to analyze exactly what has been stolen. The logic of what to steal could vary based on the environment etc.
- remram 6y ago> It would probably just open up a reverse shell or something like that Codecov is a service meant to be run in CI, so your reverse shell would just be running in a GitHub/GitLab/... CI job. Not very interesting. You can however grab tokens from the environment that will give you access to the GitHub/GitLab/... repositories, which is much more valuable than getting a shell. It looks like it's exactly what they did: https://news.ycombinator.com/item?id=26825432 https://news.ycombinator.com/item?id=26825432