UnknownPublished 19 Jan 2023

OSINT · CircleCI incident report for January 4, 2023 security incident

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - CircleCI incident report for January 4, 2023 security incident

Impact

For European organizations, particularly those heavily reliant on CI/CD pipelines and cloud-based development tools like CircleCI, this incident poses risks including unauthorized access to build environments, potential codebase tampering, and supply chain compromise. If attackers leverage SSH access to inject malicious payloads, this could lead to compromised software integrity, data breaches, or disruption of software delivery processes. The impact extends to intellectual property theft, reputational damage, and regulatory compliance issues under GDPR if personal data is involved. Organizations with automated deployment pipelines may face operational disruptions and increased incident response costs. The medium severity suggests a moderate but tangible risk, especially for sectors with critical software development needs such as finance, telecommunications, and technology firms across Europe. The lack of patches or detailed remediation guidance necessitates proactive security measures to mitigate potential exploitation.

Defensive guidance

European organizations should immediately audit and rotate all SSH keys and credentials used within their CircleCI and broader CI/CD environments to prevent unauthorized access. Implement strict SSH key management policies, including the use of ephemeral keys and limiting key scope and permissions. Enhance monitoring and logging of SSH sessions and CI/CD pipeline activities to detect anomalous behavior indicative of compromise. Employ network segmentation to isolate CI/CD environments from sensitive production systems. Use multi-factor authentication (MFA) for accessing CI/CD tools and related infrastructure. Regularly review and update access control lists and permissions for build agents and deployment targets. Conduct thorough incident response drills focusing on supply chain and CI/CD compromise scenarios. Engage with CircleCI support and security advisories for any updates or patches. Additionally, consider deploying runtime application self-protection (RASP) and endpoint detection and response (EDR) solutions to identify and mitigate payload delivery attempts and artifact drops.

Indicators of compromise

Domains 2

potrax.comBlock the following domain
ptx.appMalicious files to search for and remove:

IP addresses 8

178.249.214.10
178.249.214.25
111.90.149.55
188.68.229.52
72.18.132.58
89.36.78.135
89.36.78.109
89.36.78.75

Hashes 1

Malicious files to search for and remove:

8913e38592228adc067d82f66c150d87004ec946e579d4a00c53b61444ff35bf

File 3

Malicious files to search for and remove:

/private/tmp/.svx856.log
/private/tmp/.ptslog
PTX-Player.dmg

Regkey 1

Review GitHub audit log files for unexpected commands such as:

repo.download_zip

Link 1

https://circleci.com/blog/jan-4-2023-incident-report/

Text 2

On January 4, 2023, we alerted customers to a security incident. Today, we want to share with you what happened, what we’ve learned, and what our plans are to continuously improve our security posture for the future. We would like to thank our customers for your attention to rotating and revoking secrets, and apologize for any disruption this incident may have caused to your work. We encourage customers who have yet to take action to do so in order to prevent unauthorized access to third-party systems and stores. Additionally, we want to thank our customers and our community for your patience while we have been conducting a thorough investigation. In aiming for responsible disclosure, we have done our best to balance speed in sharing information with maintaining the integrity of our investigation.
Report

Community reviews

Loading reviews…