Does this also include deploy SSH keys?
Looks like yes: https://discuss.circleci.com/t/circleci-security-alert-rotat...
CircleCI security alert: Rotate any secrets stored in CircleCI
41–50 of 87 posts
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#42Earlier quoted context omitted.
Given the wording of "any and all secrets" I would not take any chances.
"Immediately rotate any and all secrets stored in CircleCI. These may be stored in project environment variables or in contexts." The blog post calls out "environment variables" and "contexts"
Emphasis on may be; not to mention, they are actively investigating the breach and do not have all the information at this time.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#43Perhaps just unfortunate timing, but of note: this comes approximately a month after CircleCI reduced their staff by about 17%[1]. [1]: https://circleci.com/blog/ceo-jim-rose-email-to-circleci-emp...
Not even a month, only 14 days between your linked post (Dec 7) and when secrets might have been leaked ("starting from December 21, 2022 through today, January 4, 2023")
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#44I really don't understand why you use someones else's computer to compile and test your stuff.
When their computers are compromised, by internal or external crooks, the crooks have full access to your code, and - in some cases - your data. If they wanted, they could inject their own shit into your binaries, totally ruining your reputation.
As a bonus, you get to pay a premium!
I still compile and test my code on my own machines, in my own network. It's much faster than CircleCI, cheaper, and it's ∞ safer.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#45I legitimately don't understand how the ranking on HN works sometimes. How is it that there are older, less-commented posts ranking higher than this story? @dang?
edit: I sincerely think this should be bumped, given how many folks don't seem to be getting the news here in a timely fashion.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#46Had one legacy app still on CircleCI and figured may as well move it over to GH actions if we're already rotating tokens anyway. Really hard to recommend anything else these days.
I'm kinda in the same boat. We've just started to experiment with GH Actions and I'm really liking it. This is just going to move the needle faster.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#47Earlier quoted context omitted.
To assume a role with OIDC you'd need to do it from the context of a specific CircleCI job run - getting access to the secrets of a particular CircleCI account alone would not be enough to authenticate to AWS (unlike when you use IAM user credentials). Even if the attacker had access to env vars from running jobs (which includes the signed token needed to do an OIDC role assumption), those tokens have a short expiry…
This only applies if the stolen credentials can’t create roles and can’t modify existing roles.
This is a good reminder to always follow least-permission best practices.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#48Why on earth haven't I received an email from Circle about this?? I guess the answer is, why on earth am I still using Circle CI.... Thankfully all of my secrets/env variables are just dummy data for tests, and already using OIDC
Check your personal Github account email.
yeah I did. None anywhere
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#49Had one legacy app still on CircleCI and figured may as well move it over to GH actions if we're already rotating tokens anyway. Really hard to recommend anything else these days.
People on my team are talking about it, I'd say this incident is the end of our trust in Circle CI going forwards.
On the other hand, I'm becoming increasingly weary of putting all my eggs in the Microsoft basket if move our source code, build system, dev environments (codespaces) to GitHib, is it just me ?
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#50I really don't understand why you use someones else's computer to compile and test your stuff. When their computers are compromised, by internal or external crooks, the crooks have full access to your code, and - in some cases - your data. If they wanted, they could inject their own shit into your binaries, totally ruining your reputation. As a bonus, you get to pay a premium! I still compile and test my code on my o…
It's nice you can do that, it doesn't work for large distributed teams.