Push implants across repositories

Code Security SCM Posture CI/CD Posture

The Push Implants across Repositories attack technique is a type of lateral movement tactic where an attacker gains access to a victim's code repository, modifies the code by implanting malicious code or backdoors, and pushes the modified code back to the repository.
This technique often involves the attacker stealing valid credentials, such as login credentials or SSH keys, to gain access to the victim's code repository.
They then modify the code, implanting the malicious code or backdoors, and push the modified code back to the repository.
The victim then unknowingly deploys the modified code, resulting in the compromise of their systems.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below. DEF CON 31: GitHub Actions Worm spreads through the Actions dependency tree.

Mitigations

M1661 Revoke user permissions
M1730 Implement code reviews

Detections

D1261 Implement penetration testing
D1262 Implement vulnerability assessment
D1510 Implement Intrusion Detection System and anti-malware
D1590 Implement continuous monitoring and logging of the CI/CD process

Push implants across repositories

Where this idea came from

Mitigations

Detections

Observed in incidents (18)

References