Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CircleCI security alert: Rotate any secrets stored in CircleCI

circleci.com

Post reply on HN
Print view View original

61–70 of 87 posts

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#61

Post by bunbun69 »

jgaa wrote: post #44

I really don't understand why you use someones else's computer to compile and test your stuff. When their computers are compromised, by internal or external crooks, the crooks have full access to your code, and - in some cases - your data. If they wanted, they could inject their own shit into your binaries, totally ruining your reputation. As a bonus, you get to pay a premium! I still compile and test my code on my o…

I don't like to run my code on someone else's machine either, but having a separate build system allows you to run full, long running tests while you continue with your work.

I can see why you would use GitHub actions if you already host your code there, but I don't feel comfortable sharing my signing keys

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#63

Post by lrvick »

hacb wrote: post #59
lrvick wrote: post #53

Earlier quoted context omitted.

Sure it does. Do engineers not compile their code locally constantly as a part of the process of writing it? Store deterministic hashes of expected binaries with signed commits in PRs. Then untrusted CI merely needs to generate and sign -matching- hashes and now we are good as long as the engineer and CI system are not compromised at the same time.

What about testing? In my company, before any code goes to production it has to go through hundreds if not thousands of unit tests. This can't be done on a dev laptop (see XKCD #303)

Testing is a separate concern than supply chain security. Testing should also never require any secrets useful to an adversary, so third party hosted CI is low risk here.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#65

Post by bamboozled »

csomar wrote: post #52
bamboozled wrote: post #51

> We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing. We will provide you updates about this incident, and our response, as they become available. At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative meas…

I can see you are bamboozled. But you should have seen the writing on the wall for CircleCI for quite some time now.

Agreed, how was I supposed to know that Circle CI would lose all the secret keys? I mean I always knew it was a possibility and our team planned for it...but what are you actually talking about?

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#66

Post by bamboozled »

aequitas wrote: post #56
bamboozled wrote: post #51

> We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing. We will provide you updates about this incident, and our response, as they become available. At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative meas…

> so we're asking teams to spend potentially hours or days fixing things At the risk of sounding pedantic, but this is why you have everything as IaC. These kind of changes should not cost days. It should take merely minutes or an hour tops to change all your keys. It should be trivial, for cases just like this.

I fully agree, our team just had to change one set of keys, other teams didn't follow best practices and are in a bad situation.

It's not Circle's fault people didn't do things propertly, but I think they just owe us a better explanation.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#67

Post by tootie »

aequitas wrote: post #56
bamboozled wrote: post #51

> We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing. We will provide you updates about this incident, and our response, as they become available. At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative meas…

> so we're asking teams to spend potentially hours or days fixing things At the risk of sounding pedantic, but this is why you have everything as IaC. These kind of changes should not cost days. It should take merely minutes or an hour tops to change all your keys. It should be trivial, for cases just like this.

You can't use IaC to change third-party API keys. And woe unto any service that doesn't allow multiple keys because then you're looking at outages.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#68

Post by icco »

taf2 wrote: post #60
csomar wrote: post #52

Earlier quoted context omitted.

I can see you are bamboozled. But you should have seen the writing on the wall for CircleCI for quite some time now.

Can elaborate where would I have seen the writing for this? What indicators did you see?

Layoffs and outages at Circle. software supply chain attacks becoming more and more popular.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#69

Post by varunsharma07 »

arkadiyt wrote: post #2

Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.

While OIDC is a good option, at StepSecurity, we are building an open-source project that allows using your MFA tokens for deployments in CI/ CD. So far, it is implemented for GitHub Actions - https://github.com/step-security/wait-for-secrets. In this method, you get a link in the build log, click the link, and can enter credentials at run time, which then gets used in the next step in the pipeline for deployment. So there are no persistent secrets stored in the CI/ CD pipeline and no need for managing/ rotating separate deployment credentials.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#70

Post by ryanisnan »

csomar wrote: post #52
bamboozled wrote: post #51

> We wanted to make you aware that we are currently investigating a security incident, and that our investigation is ongoing. We will provide you updates about this incident, and our response, as they become available. At this point, we are confident that there are no unauthorized actors active in our systems; however, out of an abundance of caution, we want to ensure that all customers take certain preventative meas…

I can see you are bamboozled. But you should have seen the writing on the wall for CircleCI for quite some time now.

I'm curious what indicators you have that this would have been the case. This is not a comment made in snark; I'm genuinely curious, as a CircleCI user who did not see the writing on the wall.
Post reply on HN