Malware Attack on CircleCI Engineer’s Laptop Leads to Recent Security Incident

Jan 14, 2023Ravie LakshmananDevOps / Data Security

DevOps platform CircleCI on Friday disclosed that unidentified
threat actors compromised an employee’s laptop and leveraged
malware to steal their two-factor authentication-backed credentials
to breach the company’s systems and data last month.

The CI/CD service CircleCI said the “sophisticated attack” took
place on December 16, 2022, and that the malware went undetected by
its antivirus software.

“The malware was able to execute session cookie theft, enabling
them to impersonate the targeted employee in a remote location and
then escalate access to a subset of our production systems,” Rob
Zuber, CircleCI’s chief technology officer, said^[1]
in an incident report.

Further analysis of the security lapse revealed that the
unauthorized third-party pilfered data from a subset of its
databases by abusing the elevated permissions granted to the
targeted employee. This included customer environment variables,
tokens, and keys.

The threat actor is believed to have engaged in reconnaissance
activity on December 19, 2022, following it up by carrying out the
data exfiltration step on December 22, 2022.

“Though all the data exfiltrated was encrypted at rest, the
third-party extracted encryption keys from a running process,
enabling them to potentially access the encrypted data,” Zuber
said.

The development comes a little over a week after CircleCI urged
its customers to rotate all their secrets^[2], which it said was
necessitated after it was alerted to “suspicious GitHub OAuth
activity” by one of its customers on December 29, 2022.

Upon learning that the customer’s OAuth token had been
compromised, it proactively took the step of rotating all GitHub
OAuth tokens, the company stated, adding it worked with Atlassian
to rotate all Bitbucket tokens, revoked Project API Tokens and
Personal API Tokens, and notified customers of potentially affected
AWS tokens.

Besides limiting access to production environments, CircleCI
said it has incorporated more authentication guardrails to prevent
illegitimate access even if the credentials are stolen.

It further plans to initiate periodic automatic OAuth token
rotation for all customers to deter such attacks in the future,
alongside introducing options for users to “adopt the latest and
most advanced security features available.”