Abusing CI/CD - Top Ways to Reach Production
summary
CI/CD pipelines are a massive attack surface: 58 million Jenkins executions/month is one cited metric, and real incidents include SolarWinds, Codecov and malicious npm packages that steal environment variables and AWS credentials. The talk details three concrete PPE methods—direct/indirect/public PPE—where attackers run malice via modified Jenkinsfiles or referenced Makefiles or public forks, plus a GitHub Actions trick where workflows run as the GitHub Actions bot approves PRs to bypass branch protections. A fix exists but org settings may still be insecure; CICD GOAT and a Top-10 risks list are available.
AI-written summary · about
chapters (8)
- 0:00Introduction to CI/CD risks
- 2:56The evolving attack surface
- 7:31Attack vectors and methodology
- 10:58Direct poison pipeline execution
- 15:14Indirect poison pipeline execution
- 17:38Public poison pipeline execution
- 21:42Bypassing pull request reviews
- 27:11Conclusion and resources
related talks
51mHow hackers can breach your C.I / C.D systems
42mProtecting CI/CD from malicious deploys
26mYour code might be secure, but what about your pipeline? ...
38mSecuring your CI/CD Pipeline
28mPwning the CI (with GitHub Action Workflows)
28mStandard Classification: Threat Modeling the CI/CD Pipeline to Improve Softwar...
37mIs Your Approach to Pipeline Security Flawed? Rethinking CI/CD Security
32mCI/CD: Top 10 Security Risks