Exploiting Continuous Integration (CI) and Automated Build systems
Discovering and exploiting CI/CD build system vulnerabilities for container compromise and persistence.
Summary
CI/CD Infrastructure
Continuous Integration has revolutionized development through automation of code builds, tests, and deployments. This saves time and resources while enabling rapid deployment.
Security Implications
Sudden demand for CI systems drove adoption of practices with large security implications, especially for internally hosted systems.
Automated Testing and Exploitation
A tool automates offensive testing against popular CI systems. Web hook initiation provides attack vectors, especially for public code repository changes.
Exploration and Demonstration
The presentation overviews popular CI tools and security benefits. Specific vulnerability examples show exploitation opportunities. Tools demonstrate capability to exploit CI implementations, establish persistence, and achieve command and control in vulnerable build containers. Modular design facilitates exploration of additional CI products and exploitation concepts.
Related talks
Adversary Village·37 min
Gil Biton
Gil Biton demonstrates building automated CI/CD weaponization pipelines to scale red team payload generation, obfuscation, and EDR evasion testing.
The Linux Foundation·12 min
Tracy Ragan
Explores lightning Talk: SSDF Is Not a Checklist: Turning Tasks Into CI/CD Automation and evaluates key implications for security practitioners.
Hacktivity - IT Security Festival·30 min
Analysts investigate attack surfaces and defenses concerning #Hacktivity2020 // Infra security automation in CI/CD: impossible is nothing. 2/2 by Spyros Manglis.