LIVE DEMO: Supply Chain Attack in the Terraform Registry
summary
Live demo shows the Terraform Registry can be manipulated so a malicious module version replaces a published tag and delivers code that stole Azure/AWS session tokens plus environment and SSH files. Attack uses Terraform’s CloudFront CDN cache and a Terraform‑version header — a used CloudFront two‑week cache cache miss forces fetch from origin — and runs external scripts that exfiltrated via Azure login user‑agent (payload encrypted with a public key and recovered from sign‑in logs). Demo succeeds; mitigation: pin commit hashes or use the provided module‑lock generator.
AI-written summary · about
chapters (19)
- 0:00Supply chain attacks intro
- 1:17What is a supply chain attack
- 2:01SolarWinds attack case study
- 5:55NotPetya attack case study
- 8:25XZ Utils attack case study
- 12:16Rising supply chain threats
- 12:58Terraform module dependency risks
- 15:27Live demo setup overview
- 20:37Exploiting registry cache
- 23:11Malicious payload execution
- 27:49Data exfiltration demo
- 32:21Automated tool detection limits
- 33:19How registry loads modules
- 34:227-year-old registry flaw
- 37:36Limitations of commit hashes
- 38:29HashiCorp’s vulnerability response
- 39:53Mitigating supply chain risks
- 45:29Terraform module lock solution
- 47:16Q&A
related talks
47mLIVE DEMO: Supply Chain Attacks in the Terraform Registry
44mAttacking & Defending Supply Chains. How we got Admin in your Cloud,...
05mUsing Terraform Safely
01h 00mGotchas using Terraform in a secure delivery pipeline
52mApisecure, 14 & 15 March 2023 - Mike McCabe, President at Cloud Security Partners.
59mPentesting Azure Container Services
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
30mTales of Red Teaming