Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public secrets exposure leads to supply chain attack on GitHub CodeQL

praetorian.com

Post reply on HN
Print view View original

31–40 of 66 posts

Re: Public secrets exposure leads to supply chain attack on GitHub CodeQL

#31

Post by [deleted] »

hobs wrote: post #27
milch wrote: post #24

Earlier quoted context omitted.

AWS throws errors that look like `arn:aws:iam:... is not authorized to call "$SERVICE_NAME:$API_NAME" on resource arn:aws:$SERVICE_NAME:...`. I think it's more complicated when you go cross account, and the receiving account doesn't have permissions set up (if the calling account doesn't have it set up you get the same error). In any case you would still find that information in the CloudTrail logs of the receiving a…

Right, you can go to cloudtrail and probably get it, but I have definitely ran into things like service says you do not have access to resource or it does not exist - randomly providing the account some other tangentially related permission magically fixes it, I've found sometimes trying the UI and the API will give different errors to help, and neither is particularly more useful than the others.

[deleted]

Re: Public secrets exposure leads to supply chain attack on GitHub CodeQL

#32

Post by bshacklett »

hobs wrote: post #27
milch wrote: post #24

Earlier quoted context omitted.

AWS throws errors that look like `arn:aws:iam:... is not authorized to call "$SERVICE_NAME:$API_NAME" on resource arn:aws:$SERVICE_NAME:...`. I think it's more complicated when you go cross account, and the receiving account doesn't have permissions set up (if the calling account doesn't have it set up you get the same error). In any case you would still find that information in the CloudTrail logs of the receiving a…

Right, you can go to cloudtrail and probably get it, but I have definitely ran into things like service says you do not have access to resource or it does not exist - randomly providing the account some other tangentially related permission magically fixes it, I've found sometimes trying the UI and the API will give different errors to help, and neither is particularly more useful than the others.

assuming you can get the cloud trail message sometimes there’s more information that you can decode using the STS service:

https://docs.aws.amazon.com/cli/latest/reference/sts/decode-...

Re: Public secrets exposure leads to supply chain attack on GitHub CodeQL

#33

Post by UltraSane »

setr wrote: post #14
declan_roberts wrote: post #12

Earlier quoted context omitted.

I think we all know this old story. The engineer building it was getting permission denied so they gave it all the permissions and never came back and right-sized.

Does any RBAC system actually tell you the missing permissions required to access the object in question? It’s like they’re designed to create this behavior

AWS has a neat feature to analyze cloudtrail logs to determine needed permissions.

Re: Public secrets exposure leads to supply chain attack on GitHub CodeQL

#36

Post by asmosoinio »

ryao wrote: post #8

I put CodeQL in use in OpenZFS PRs. This is not an issue for OpenZFS. None of our code is secret. :)

I don't think this is a good take: Even if your code is not secret, the attack could add anything to your code or release artifacts.

Luckily it was quickly remedied at least.

Re: Public secrets exposure leads to supply chain attack on GitHub CodeQL

#40

Post by mdaniel »

ashishb wrote: post #39

I am getting more and more convinced that CI and CD should be completely separate environments. Compromise of CI should not lead to token leaks related to CD.

This area is near and dear to my heart, and I would offer that the solution isn't to decouple CD over into its own special little thing but rather to make the CD "multi factor" in that it must be "sub":"repo:octo-org/octo-repo:environment:prod"[1] and feel free to sprinkle in any other [fun claims][] you'd like to harden that system

1: https://docs.github.com/en/actions/security-for-github-actio...

fun claims: https://github.com/github/actions-oidc-debugger#readme

Post reply on HN