A view of the entrance into the Rapid7 offices. The company confirmed that âa small subsetâ of its source code repositories and some customer credentials and other data were accessed by an unauthorized party. (Rapid7)
Security vendor Rapid7 confirmed that âa small subsetâ of its source code repositories and some customer credentials and other data were accessed by an unauthorized party following a breach of code-testing company Codecov last month.
In an unsigned May 13 blog, the company said that following an internal investigation that included âvalidationâ from an unnamed cybersecurity forensics firm, they determined that there was a âlimitedâ impact on Rapid7âs network and customer data.
Codecov Affected by Supply-Chain Attack; Notifies Customers
Microsoft Warns of 25 Critical Memory-Allocation Vulnerabilities in IoT Devices
Babuk Gang to Focus on Data-Theft Extortion instead of Ransomware
Information of 22 Million ParkMobile Customers Released for Free on Hacking Forum
Musical Instrument Marketplace Reverb Discloses Data Breach
Code coverage and software auditing company Codecov recently suffered a supply-chain attack where a threat actor gained access to its Bash Uploader script, altering it to exfiltrate sensitive information from customer environments. Threat actors gained credentials to modify the script by taking advantage of weaknesses in Codecov’s Docker image creation process.
Codecov discovered the compromise on April 1 and began notifying affected customers and providing IOCs on April 30. However, investigation shows the attack first began unnoticed in late January. U.S. federal authorities have also now joined the investigation. Hundreds of cust
Codecov s Bash Uploader script could be verified to check for tampering via a cryptographic checksum, but despite this it was a couple of months before the compromise was detected. The use of the script within GitHub actions was one example where the checksum was not inspected.
Following the security incident, GitHub users raised an issue, Checksum should be run on bash uploader script before execution, with one developer remarking that the idea to directly and blindly execute a bash script pulled from the web is a giant security hole and a ticking bomb for future breaches.
Codecov attempted to add verification to the GitHub Action which then started raising false positives thanks to a mismatch between the checksum and the script actually in use. This is the kind of friction which undermines efforts to improve security.
POLITICO
Get the Weekly Cybersecurity newsletter
Email
Sign Up
By signing up you agree to receive email newsletters or updates from POLITICO and you agree to our privacy policy and terms of service. You can unsubscribe at any time and you can contact us here. This sign-up form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Presented by
With help from Eric Geller
Editor’s Note: Weekly Cybersecurity is a weekly version of POLITICO Pro’s daily Cybersecurity policy newsletter, Morning Cybersecurity. POLITICO Pro is a policy intelligence platform that combines the news you need with tools you can use to take action on the day’s biggest stories. Act on the news with POLITICO Pro.
Among the first of many? Software tools biz reports internal use of credential-stealing script
Tim Anderson Mon 26 Apr 2021 // 19:35 UTC Share
Copy
HashiCorp, an open-source company whose Terraform product is widely used for automated cloud deployments, has revealed a private code-signing key was exposed thanks to the compromised Codecov script discovered earlier this month.
Codecov, which provides tools to assess how much of an application s code is subject to unit tests, reported that a script used to upload data to its servers was modified to export credentials to an attacker s server. The company said it had not been able to determine conclusively who carried out the event.