By Gagandeep Singh
17-Jan-2023
CircleCi, a popular Continuous Integration & Continuous Development platform used for DevOps practices revealed that it suffered a security exploit.
In December, An engineer at CircleCi was infected with information-stealing malware, hackers used to breach their 2FA-backed SSO session cookie which allowed the attackers access to CircleCi’s internal systems.
A report published by CircleCi mentions that they got to know about the security exploit after a customer reported that their GitHub OAuth code had been compromised.
As soon as the company learned about the security breach, they sent an email to customers notifying them to spin all their tokens & secrets if they logged in after 21 December.
The malware stole the corporate session cookie, which had been already authenticated via the 2FA, which allowed the attackers to login in as users without having to authenticate it.
Malware executed session cookie theft, thereby enabling the hackers to impersonate the employee they were targeting in a remote location and then amplified access to the sub-net of the production systems.
Although the company had encrypted the data, attackers stole the encrypted keys by throwing them into the running process, possibly allowing the attackers to de-encrypted the encrypted stolen data.
The company mentions that they have already spun all the tokens belonging to their customers, which include GitHub OAuth, Personal API tokens, and Project API tokens.