Poisoned Pipeline / Techniques / T0143
External user accounts
External User Accounts attack technique in the CI/CD, SCM posture and cloud security involves compromising external user accounts to gain unauthorized access to CI/CD pipelines, source code repositories or cloud systems.
Attackers may gain unauthorized access to these accounts through various means, such as phishing, social engineering, or password cracking.
Once compromised, attackers can inject malicious code into CI/CD pipelines, tamper with deployment pipelines, manipulate source code repositories, or access cloud systems.
This can result in the deployment of unauthorized or malicious code to production systems, introduction of vulnerabilities or backdoors into source code, theft of intellectual property, or other malicious activities.
Where this idea came from
AS20 (@7nohe) let any external commenter run the publish path; prt-scan and hackerbot-claw used throwaway external accounts. Also OWASP CICD-SEC-2.
- https://www.stepsecurity.io/blog/7nohe-openapi-react-query-codegen-compromised-npm-publishing-workflow
- https://www.stepsecurity.io/blog/prt-scan-github-actions-exfiltration-campaign
- https://owasp.org/www-project-top-10-ci-cd-security-risks/
Mitigations
- M1450 Implement zero trust
- M1451 Use network segmentation
- M1550 Implement strict access control for clouds
- M1661 Revoke user permissions
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1430 Monitor for failed login attempts
- D1431 Monitor for changes of user permissions
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (3)
- BdThemes plugins poisoned through the vendor's banner feed
- hackerbot-claw autonomous GitHub Actions exploitation
- prt-scan 219 malicious PRs stealing CI secrets