seanyeoh & devec0: Continuous Intrusion: Hacking CI Systems
Examines seanyeoh & devec0: Continuous Intrusion: Hacking CI Systems and evaluates key implications for security practitioners.
Summary
Overview: Sean Yeoh and devec0 present at NahamCon on hacking CI/CD systems, covering attack vectors, sandbox escapes, and secret exposure in continuous integration pipelines.
Key Topics: CI/CD system architecture and trust boundaries; sandbox escape techniques from build containers; scoping circumvention to access additional secrets; privilege escalation in pipeline environments; and financial impact of CI/CD compromise.
Technical Details: Presenters demonstrate escaping CI/CD sandboxes, escalating privileges, and accessing secrets beyond intended scope. They outline a methodology for assessing CI/CD systems across container escape, privilege escalation, and secret harvesting vectors.
Takeaways: CI/CD systems aggregate secrets and privileged access, making them high-value targets. Security teams must treat pipeline infrastructure as critical assets with dedicated assessment and monitoring.
Related talks
NahamCon·35 min
Evaluates #NahamCon2022 - @infosec_au: Finding 0days in Enterprise Web Applications and evaluates key implications for security practitioners.
NahamCon·37 min
Analyzes #NahamCon2022 - @gregxsunday: Effectively finding vulnerabilities by debugging the source code and evaluates key implications for security practitioners.
NahamCon·18 min
Discusses #NahamCon2022 - @Farah_Hawaa: What practitioners learnt from a year of triaging bug bounty reports and evaluates key implications for security practitioners.