Poisoned Pipeline / Techniques / T0192
Sensitive information in logs
Operational logs are a valuable source of information for organizations to monitor their systems and applications, identify issues, and improve their overall security posture. However, these logs can also contain sensitive information such as personally identifiable information (PII) data, tokens, credentials, and internal system information.
While this information may be useful to legitimate system administrators and security personnel, it can also be highly valuable to attackers who want to exploit vulnerabilities in the system. An adversary may attempt to gain access to the operational logs in order to steal valuable data or deepen their attack by using the information contained within the logs to escalate their privileges and move laterally within the organization's network.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://medium.com/google-cloud/protect-sensitive-info-in-logs-using-google-cloud-4548211d4654
- https://www.logiq.ai/6-ways-to-protect-sensitive-data-in-logs/
Mitigations
- M1300 Implement log sanitization
- M1301 Implement log sanitization
- M1302 Implement strict access controls for logs
- M1440 Review logging settings
- M1441 Implement centralized logging
Detections
- D1131 Implement SIEM
- D1300 Implement regular log reviews
Observed in incidents (2)
- Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
- Codecov Breach