Poisoned Pipeline / Techniques / T0130
Harvest secrets from logs
CI/CD Posture Secrets Hygiene
This attack involves searching through logs generated by a system to find sensitive information that may have been inadvertently logged.
Such information can include passwords, API keys, access tokens, or other types of credentials.
In many systems, logs are generated automatically as part of normal operations.
Attackers can exploit this by searching through the logs to find any sensitive information that has been logged.
Once this information is found, the attacker can use it to gain unauthorized access to the system or associated resources.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Sub-techniques
- T0162 Passwords in CI/CD logs
Mitigations
- M1300 Implement log sanitization
- M1301 Implement log sanitization
- M1302 Implement strict access controls for logs
- M1120 Store credentials in vault
Detections
- D1131 Implement SIEM
- D1300 Implement regular log reviews
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (4)
- tj-actions/changed-files GitHub Action
- Miri writes env secrets into target/ readable from PR caches
- CircleCI December 2022 / January 2023 incident
- LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader