Poisoned Pipeline / Techniques / T0149
Delete repositories
A delete repository attack technique in a CI/CD pipeline is a type of denial-of-service (DoS) attack that targets the code repositories used by the pipeline.
The goal of the attack is to delete the repositories or make them unavailable, thus disrupting the pipeline's ability to build and deploy software.
In a typical CI/CD pipeline, code repositories are an essential component as they contain the source code for the application that is being built and deployed.
In a delete repository attack, an attacker gains unauthorized access to the repositories and deletes the source code.
This can cause significant disruptions to the pipeline, leading to delays in software releases or even complete downtime of the system.
Where this idea came from
Destructive npm packages and wget-to-wipeout Go modules deleted host codebases on remote trigger; SLSA models the same as an availability threat.
- https://socket.dev/blog/destructive-npm-packages-enable-remote-system-wipe
- https://slsa.dev/spec/v1.0/threats
Mitigations
- M1490 Restrict the ability to delete repositories
- M1491 Implement backup and recovery
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1490 Monitor repository access
- D1590 Implement continuous monitoring and logging of the CI/CD process