How to steal Azure DevOps secrets
summary
Demonstrates concrete attacks and fixes: a secret printed in logs is recovered by splitting it (a substring masking bypass), or written to disk and retrieved via a publish artifact with secret, and a pipeline can git-clone any repo because build agents historically have org‑wide access unless job authorization scope is enabled. Notes defaults changed May 2020, shallow fetch cuts ~30s from builds, environment agents cut deploy time 30–80%, and recommends Azure Key Vault/managed identities to remove secrets from pipelines.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:31DevOps security settings
- 3:30Where are the secrets? (1)
- 5:32What are variable groups
- 11:36Access levels explained (Variable groups and secure files)
- 12:14Resource authorization
- 17:29Preventing pipeline modification
- 21:53Build agent user - The master ring
- 23:01Job authorization scope settings
- 25:43Azure KeyVault
- 28:04Repeat task
- 31:58Environment resources - simplify on-prem deployment
related talks
49mAzure DevOps security - Lessons learned
38mHiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
42mAzure DevOps security - Lessons learned
46mSecrets Management for the Modern Tech. Pro
44mAzure DevSecOps
22mKeep Your Enemies Close and Your Secrets Closer
10mCan you keep it a secret?
43mSecure Development