Poisoned Pipeline / Techniques / T0112
Compromised token
Access to third party APIs typically uses a token to authenticate access.
This token is usually a randomized string that is auto-generated by the API provider and should be at least 16 characters or more.
This token is passed with a request to the API provider and if the token is valid, the request is successful.
Each of these tokens will usually have a set of permissions applied to it that authorizes it to perform very simple read operations, or more complex write and delete operations.
Unfortunately, these tokens are often accidentally embedded in applications via source code or Javascript variable exposure.
Attackers will often scan web applications URLs or public git repositories for exposed credentials to then in turn use those found credentials to gain access to the victims resources.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
- https://docs.github.com/en/actions/security-guides/automatic-token-authentication
- https://support.google.com/googleapi/answer/6310037?hl=en
Sub-techniques
- T0105 Active scanning
Mitigations
- M1120 Store credentials in vault
- M1121 Enable git hooks to find source code related issues early
- M1122 Implement token management best practices
- M1123 Implement token access control and permissions
- M1124 Use token encryption and obfuscation
- M1932 Contract a supplier incident-notification clause with a reporting template and SLA
- M1933 Keep a supplier-specific incident playbook with standing risk and access detail
Detections
- D1120 Implement source code scanning for credentials and tokens
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1500 Configure monitoring of used artifacts and open-source libraries
Observed in incidents (12)
- Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
- Hijacked AI coding assistant spreads Shai-Hulud
- Spoofed Dependabot commits and secret-stealing Actions
- Keyv / Cacheable ChainDrop worm
- Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
- Docker Hub token transfer re-assigned personal access tokens without revoking them
- Multi-org GitHub PAT campaign mass-cloned repositories
- Stolen Heroku and Travis CI OAuth tokens cloned private GitHub repos
- CircleCI December 2022 / January 2023 incident
- LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
- sckit worm in MemTensor npm plugin and PyPI MemoryOS
- Brevo Cloudflare Worker ClickFix