Poisoned Pipeline / Techniques / T0103
Scan public artifacts for secrets
This technique involves scanning publicly available artifacts, such as code repositories and container images, for sensitive information such as passwords, access keys, and other secrets.
By scanning these artifacts, an attacker can gain unauthorized access to the application or underlying system and potentially cause significant damage.
For example, an attacker might use this technique to scan a public code repository for hardcoded passwords or access keys, which could then be used to gain unauthorized access to the application or the underlying system.
Alternatively, an attacker might scan a public container image for sensitive information such as database credentials, which could be used to gain access to sensitive data.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below. DEF CON 32: CloudQuarry, secrets in 3.1 million public AMIs.
- https://cycode.com/introducing-container-secret-scanning/
- https://docs.gitlab.com/ee/user/application_security/secret_detection/
- https://defcon.org/html/defcon-32/dc-32-speakers.html#54518
Mitigations
- M1120 Store credentials in vault
- M1732 Implement code scanning for security risks
- M1890 Encrypt secrets
Detections
- D1120 Implement source code scanning for credentials and tokens
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment