Poisoned Pipeline / Techniques / T0153
Compromised developer workstation
Compromised developer workstation attack is a technique where an attacker gains access to a developer's machine, which contains sensitive information such as access credentials, keys, and code repositories.
This technique can allow an attacker to steal code or modify it to include backdoors or other malicious code.
The attacker can also use this access to gain entry into other systems within the organization.
This type of attack can be carried out through various means, such as Phishing, Typosquatting, Brandjacking, malicious IDE extensions, or exploiting vulnerabilities in the developer's system.
Once the attacker gains access, they can install malware or backdoors, extract sensitive information, or use the machine as a foothold to carry out further attacks.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1530 Use multi-factor authentication
- M1531 Implement endpoint security solutions
- M1532 Implement least privilege access controls
- M1720 Implement regular patches and updates
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
Observed in incidents (13)
- Fake corepack.org infostealer and proxyware
- CCleaner 5.33 signed ShadowPad backdoor
- TraderTraitor interview repos point Terraform at a lookalike provider registry
- pub.dev universal_file_viewer ships XCSSET (infected maintainer)
- Spoofed Dependabot commits and secret-stealing Actions
- Fake TradingView macOS installer via YouTube ad
- SolarWinds
- Nx Console VS Code 18.95.0 (GitHub internal repo theft)
- Keyv / Cacheable ChainDrop worm
- Placeholder domain third-party.com turned live ClickFix server
- CircleCI December 2022 / January 2023 incident
- 3CX Desktop
- BRIDGEHEAD npm typosquats jump WSL to a Windows wallet stealer