Breaking Build: Red Teaming CI/CD Pipelines and GitHub Actions [BSidesPDX 2024]
Analysts investigate attack surfaces and defenses concerning Breaking Build: Red Teaming CI/CD Pipelines and GitHub Actions [BSidesPDX 2024].
Summary
Breaking build: red teaming CI/CD pipelines and GitHub Actions.
Related talks
Main Stage·42 min
Aviad Hahami
Reconstructs the multi-stage CI/CD supply chain compromise of the popular tj-actions GitHub Action, detailing secret exfiltration and attacker tradecraft.
supply-chaingithub-actionsci-cd+2
App Sec Village·26 min
Elad Pticha · Oreen Livni
Demonstrates a command injection vulnerability in the Bazel GitHub Action that allowed malicious tampering in Google's build pipeline.
ci-cdgithub-actionsbazel+2
Main Stage·44 min
Adnan Khan · John Stawinski
Exploiting insecure defaults in self-hosted GitHub Actions runners to compromise repositories, cloud environments, and internal networks.
github-actionsci-cdsupply-chain+2