CircleCI security alert: Rotate any secrets stored in CircleCI • Hacker News Board

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#81

Post by rupert-m-a » Fri, Jan 06, 2023, 7:38 AM UTC

I've created a tool due to this incident to help you find your secrets in CircleCi.

https://github.com/rupert-madden-abbott/circleci-audit

It can: * List env vars attached to your repos and contexts * List SSH keys attached to your repos * List which repos are configured with Jira (a secret that might need rotating)

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#82

Post by starwatch » Fri, Jan 06, 2023, 11:43 AM UTC

rupert-m-a wrote: post #81

I've created a tool due to this incident to help you find your secrets in CircleCi. https://github.com/rupert-madden-abbott/circleci-audit It can: * List env vars attached to your repos and contexts * List SSH keys attached to your repos * List which repos are configured with Jira (a secret that might need rotating)

Thanks for taking the initiative!

Circle CI have also released something similar [0] linked to near the bottom of their blog post[1].

[0]: https://github.com/CircleCI-Public/CircleCI-Env-Inspector

[1]: https://circleci.com/blog/january-4-2023-security-alert/

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#83

Post by lrvick » Fri, Jan 06, 2023, 11:45 AM UTC

mnahkies wrote: post #73

lrvick wrote: post #53

Earlier quoted context omitted.

Sure it does. Do engineers not compile their code locally constantly as a part of the process of writing it? Store deterministic hashes of expected binaries with signed commits in PRs. Then untrusted CI merely needs to generate and sign -matching- hashes and now we are good as long as the engineer and CI system are not compromised at the same time.

You're talking about creating reproducible builds - which is a good idea, but in most cases you will still need to deliver that binary somewhere. That typically requires authentication, whether you're deploying to kubernetes or copying the files somewhere using scp, etc So either your laptop or the ci system needs some level of secrets present to put the artifact in the correct place

Engineers simply commit artifacts with Git LFS as a signed commit. Totally unprivileged build systems can append reproducible build signatures via git tags. That repo can be webhook triggered to be -pulled- by a lambda job or similar in the target environment that will the verify tags and signatures to assert if it is valid, and deploy artifacts to signature approved environments using ephemeral role credentials.

A VCS system or CI system should never have secrets or be trusted in any way. Doing this is always dramatically increases attack surface for no reason.

I run a security consulting firm and this is often one of the first things I help my clients to fix.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#84

Post by wlonkly » Fri, Jan 06, 2023, 3:44 PM UTC

herpderperator wrote: post #13

No email? I found out about this from a random HN post?

Based on who received and didn't receive it at my workplace, we concluded that it was only sent to users who had not unsubscribed from marketing mail.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#85

Post by benced » Fri, Jan 06, 2023, 5:44 PM UTC

You have to trust a CI provider almost as much as your production host. Circle has not earned the same trust as organizations like AWS.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#86

Post by herpderperator » Sat, Jan 07, 2023, 5:08 AM UTC

wlonkly wrote: post #84

herpderperator wrote: post #13

No email? I found out about this from a random HN post?

Based on who received and didn't receive it at my workplace, we concluded that it was only sent to users who had not unsubscribed from marketing mail.

That would be it. It should have been sent as a forced account-related email. How strange of them to do that.

Re: CircleCI security alert: Rotate any secrets stored in CircleCI

#87

Post by berniedurfee » Sat, Jan 07, 2023, 9:59 PM UTC

icco wrote: post #68

taf2 wrote: post #60

Earlier quoted context omitted.

Can elaborate where would I have seen the writing for this? What indicators did you see?

Layoffs and outages at Circle. software supply chain attacks becoming more and more popular.

I would imagine GitHub Actions and always maturing CI tooling baked into cloud providers are rapidly eroding the market share of dedicated services like CircleCI.