/s But I thought npm was the issue, and all of this couldn't happen anywhere else?!
Don't underestimate the prowess of Microslop to fuck up. I'm just glad I saw all of this coming and abandoned this hellscape long ago.
Trivy under attack again: Widespread GitHub Actions tag compromise secrets
11–20 of 97 posts
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#12Wasn't this discovered already last week, on Friday, that the threat actor had replaced the legit images with malware images? And republished 75 out of 76 tags?
No, the actor reappeared. This article is not fully updated. On March 22nd, the actor compromised their DockerHub account and published new Docker images.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#13Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#14I always run such tools inside sandboxes to limit the blast radius.
I don't think it would help here, they were stealing credentials
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#15Friendly reminder that just because someone is building security software it doesn't mean they are competent and won't cause more harm than good. Every month the security team wants me to give full code or cloud access to some new scanner they want to trial. They love the fancy dashboards and lengthy reports but if I allowed just 10% of what they wanted we would be pwned on the regular...
I audited Trivy's GitHub Actions a while back and found some worrying things, the most worrying bit was in the setup-trivy Action where it was doing a clone of main of the trivy repo and executing a shell script in there. There was no ref pinning until somebody raised a PR a few months ago. So a security company gave themselves arbitrary code execution in everyone's CI workflows.
Aqua were breached earlier this month, failed to contain it, got breached again last week, failed to contain it again, and now the attackers have breached their Docker Hub account. Shit happens but they're clearly not capable of handling this and should be enlisting outside help.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#16You're supposed to scan for vulnerabilities, not become one!
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#17I always run such tools inside sandboxes to limit the blast radius.
The sandbox will need internet access (to update data) and you will need to send code to test into it; so compromise already equals leaking all your code, without even breaking the sandboxing
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#18[flagged]
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#19GG
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#20How the heck are credential compromises still a thing with 2FA and refresh tokens???