8 ms·
Public secrets exposure leads to supply chain attack on GitHub CodeQL
- junto 1y agoThey weren’t kidding on the response time. Very impressive from GitHub.
- belter 1y agoNot very impressive to have an exposed public token with full write credentials...
- 1a527dd5 1y agoTrying my best not to break the no snark rule [1], but I'm sure your code is 100% bullet proof against all current and future-yet-invented-attacks. [1] _and failing_.
- belter 1y ago[flagged]
- atoav 1y agoNobody is immune against mistakes, but a certain class of mistakes¹ should never ever happen to anyone who should know better. And that in my book is anybody who has their code used by more people than themselves. I am not saying devs aren't allowed to make stupid mistakes, but if we let civil engineers have their bridges collapse with an "shit happens" -attitude trust in civil engineering would be questionable at best. So yeah shit happens to us devs, but we should be shamed if it was preventable by simply knowing the basics. So my opinion is anybody who writes code that is used by others should feel a certain danger-tingle whenever a secret or real user data is put literally anywhere. To all beginners that just means that when handling secrets, instead of pressing on, you should pause and make an exhaustive list of who would have read/write access to the secret under which conditions and whether that is intended. And with things that are world-readable like a public repo, this is especially crucial. Another one may or may not be your shells history, the context of your environment variables, whatever you copy-paste into the browser-searchbar/application/LLM/chat/comment section of your choice etc. If you absolutely have to store secrets/private user data in files within a repo it is a good idea to add the following to your .gitignore: *.private *.private.* And then every such file has to have ".private." within the filename (e.g. credentials.private.json), this not only marks it to yourself, it also prevents you to mix up critical with mundane configuration. But better is to spend a day to think about where secrets/user data really should be stored and how to manage them properly. ¹: a non-exhaustive list of other such mistakes: mistaking XOR for encryption, storing passwords in plaintext, using hardcoded credentials, relying on obscurity for security, sending data unencrypted over HTTP, not hashing passwords, using weak hash functions like MD5 or SHA-1, no input validation to stiff thst goes into your database, trusting user input blindly, buffer overflows due to unchecked input, lack of access control, no user authentication, using default admin credentials, running all code as administrator/root without dropping priviledges, relying on client-side validation for security, using self-rolled cryptographic algorithms, mixing authentication and authorization logic, no session expiration or timeout, predictable session IDs, no patch management or updates, wide-open network shares, exposing internal services to the internet, trusting data from cookies or query strings without verification, etc
- sieabahlpark 1y ago[dead]
- immibis 1y ago> no input validation to stiff thst goes into your database I'd put "conflating input validation with escaping" on this list, and then the list fails the list because the list conflates input validation with escaping.
- atoav 1y agoGood point, as I mentioned, this is a non-exhaustive list. Input validation and related topics like encodings, escaping, etc could fill a list single-handedly.
- toomuchtodo 1y agoPerfect security does not exist. Their security system (people, tech) operated as expected with an impressive response time. Room for improvement, certainly, but there always is. Edit: Success is not the absence of vulnerability, but introduction, detection, and response trends. (Github enterprise comes out of my budget and I am responsible for appsec training and code IR, thoughts and opinions always my own)
- koolba 1y ago> Success is not the absence of vulnerability, but introduction, detection, and response trends. Don’t forget limitation of blast radius. When shit hits the proverbial fan, it’s helpful to limit the size of the room.
- toomuchtodo 1y agoYeah, I agree compartmentalization, least privilege, and sound architecture decisions are a component of reducing the pain when you get popped. It’s never if, just when.
- timewizard 1y ago> Perfect security does not exist. Having your CI/CD pipeline and your git repository service be so tightly bound creates security implications that do not need to exist. Further half the point of physical security is tamper evidence. Something entirely lost here.
- Aeolun 1y agoI find that this is always easy to say from the perspective of the security team. Sure, it would be more secure to develop like that, but also tons more painful for both dev and user.
- timewizard 1y agoI don't code anymore. I like making devs suffer. And this is all good for the user. ;)
- bloqs 1y agoThis sites performance is so bad i can barely scroll
- nyrikki 1y agoNo mention why this temp token had rights to do things like create a new deployments and generate artifact attestations? For their fix, they disabled debug logs...but didn't answer if they changed the temp tokens permissions to something more appropriate for a code analysis engine.
- declan_roberts 1y agoI think we all know this old story. The engineer building it was getting permission denied so they gave it all the permissions and never came back and right-sized.
- azemetre 1y agoWhat's the over/under that said engineer could solve two medium leetcodes in under and hour?
- setr 1y agoDoes any RBAC system actually tell you the missing permissions required to access the object in question? It’s like they’re designed to create this behavior
- levkk 1y agoNot usually, that's considered an potential attack vector I believe. You're looking to minimize information leakage.
- Normal_gaussian 1y agoYes. Most auth systems do to the developer - GCP & AWS IAM give particularly detailed errors; nearly every feature/permission system I have implemented did. However, it wouldn't be unusual for the full error to be wrapped or swallowed by some lazy error handling. Its a bit of a PITA but well worth it to translate to a safe and informative user facing error. as a nit; RBAC is applied to an object based permissions system rather than being one. Simply, RBAC is a simplification of permission management in any underlying auth system.
- ryao 1y agoI put CodeQL in use in OpenZFS PRs. This is not an issue for OpenZFS. None of our code is secret. :)
- deleted 1y ago[deleted]
- asmosoinio 1y agoI don't think this is a good take: Even if your code is not secret, the attack could add anything to your code or release artifacts. Luckily it was quickly remedied at least.
- atxtechbro 1y agoIs this fixed?
- lsllc 1y agoIt's in the article (and the comments here) -- yes, it was remediated within 3 hours of being reported back in January by GitHub.
- helsinki 1y agoAs someone with the last name Prater—derived from Praetorian—I really wish I owned praetorian.com.
- ashishb 1y agoI am getting more and more convinced that CI and CD should be completely separate environments. Compromise of CI should not lead to token leaks related to CD.
- nrvn 1y agoThis is essentially how separation of duties(and concerns) looks like. And this is how some of the good examples of projects work. Specific techniques and tooling and specific boundaries of CI and CD vary depending on the nature of the end product but conceptually you are absolutely right.
- mdaniel 1y agoThis area is near and dear to my heart, and I would offer that the solution isn't to decouple CD over into its own special little thing but rather to make the CD "multi factor" in that it must be "sub":"repo:octo-org/octo-repo:environment:prod"[1] and feel free to sprinkle in any other [fun claims][] you'd like to harden that system 1: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#:~:text=you%20can%20configure%20deployment%20rules%20on%20an%20environment%20to%20restrict%20which%20branches%20and%20tags%20can%20deploy%20to%20the%20environment%20or%20access%20environment%20secrets https://docs.github.com/en/actions/security-for-github-actio... fun claims: https://github.com/github/actions-oidc-debugger#readme https://github.com/github/actions-oidc-debugger#readme
- udev4096 1y agoUsing public github actions is just asking for trouble and more so without analyzing the workflow's procedure. Instead, just host one yourself using woodpecker or countless other great CI builders (circle, travis, gitlab, etc)
- Sytten 1y agoAn again this would not be so bad an impact if github finally pushed their immutable actions [1]. I sound like a broken record since I keep repeating that this would solve like 70%+ of the scope of attacks on gha today. You would think that the weekly disaster they have would finally make them launch it. [1] https://github.com/features/preview/immutable-actions https://github.com/features/preview/immutable-actions
- thund 1y agoThey probably have good reasons if it's still in preview, that could be serious bugs, security gaps, potential breaking changes that would cause more harm than good if rushed, etc
- intelVISA 1y agoToo much stakeholder alignment?
- tanepiper 1y agoMore like last year they laid off a whole bunch of people. We've been waiting for several open tickets on GitHub to be picked up, some were but seem to be abandoned and others just ignored.
- 1oooqooq 1y agothe only reason any company does or don't anything: not required for sales. in 2019 i saw a fortune500 tech company put in place their own vulnerability scanner internal application which included this feature for our enterprise github repos. the tool was built and deployed to an old Linux docker image that was never updated to not be the target of the attack they were preventing... they never vetted to random version they started with either. i guess one can still use zip bomb or even the xz backdoor for extra irony points when attacking that system. anyway, the people signing github checks also get promoted by pretending to implement that feature internally.