https://twitter.com/sanitybit/status/1610829345676996609
>I've been investigating the use of a @ThinkstCanary AWS token that was improperly accessed on December 27th and suspected as much.
CircleCI security alert: Rotate any secrets stored in CircleCI
31–40 of 87 posts
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#32Why on earth haven't I received an email from Circle about this??
I guess the answer is, why on earth am I still using Circle CI....
Thankfully all of my secrets/env variables are just dummy data for tests, and already using OIDC
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#33Why on earth haven't I received an email from Circle about this?? I guess the answer is, why on earth am I still using Circle CI.... Thankfully all of my secrets/env variables are just dummy data for tests, and already using OIDC
I have. Maybe PEBKAC
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#34Why on earth haven't I received an email from Circle about this?? I guess the answer is, why on earth am I still using Circle CI.... Thankfully all of my secrets/env variables are just dummy data for tests, and already using OIDC
Check your personal Github account email.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#35Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.
A bit of a shameless plug for a relevant Terraform module I made (specific to GitHub in this case): https://github.com/unfunco/terraform-aws-oidc-github
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#36Our hodgepodge of microservices- developed over more than a decade- never got coordinated env variables, so now we've got to go through like ~50 services & libraries, one by one, updating secrets. Yuck. If you do your shit right, you can just dump most of your secrets into some Contexts- containers of env variables- and apply them. Then when this stuff roles around, it's easy to update everything centrally; change th…
> Then when this stuff roles around, it's easy to update everything centrally; change the context & everyone sees it.
But one still has to update their credentials on any downstream service, e.g. Third-party API keys. In general, this is highly individual for each service, and can mostly only be doneanially.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#37No email? I found out about this from a random HN post?
Nobody at my org did, either.
Fun night when you need to reroll your credentials...at least it's nice to have a list in the CircleCI UI, but sucks when you need to make sure that you have all of the scopes available to you.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#38Had one legacy app still on CircleCI and figured may as well move it over to GH actions if we're already rotating tokens anyway. Really hard to recommend anything else these days.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#39Earlier quoted context omitted.
To assume a role with OIDC you'd need to do it from the context of a specific CircleCI job run - getting access to the secrets of a particular CircleCI account alone would not be enough to authenticate to AWS (unlike when you use IAM user credentials). Even if the attacker had access to env vars from running jobs (which includes the signed token needed to do an OIDC role assumption), those tokens have a short expiry…
This only applies if the stolen credentials can’t create roles and can’t modify existing roles.
...and don't leave a payload behind, to maintain persistent access (unless I'm missing something?)
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#40Does this also include deploy SSH keys?
Given the wording of "any and all secrets" I would not take any chances.
"Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts."
The blog post calls out "environment variables" and "contexts"