Trivy ɔnda atak bak: Widespread GitHub Akshɔn dɛn tag kɔmprɔmis sikrit
Di sikyɔriti fɔ di softwea sapɔt chen na jɔs lɛk aw i wik pas ɔl. Fɔ bɔku bɔku divɛlɔpmɛnt tim dɛn, da link de dɔn bi di sem tul dɛn we dɛn de abop pan fɔ fɛn vulnerabilities. Insay wan tin we bin de mɔna pipul dɛn, Trivy, we na wan pɔpul opin-sɔs vulnɛrabiliti skan we Aqua Security de mentɛn, bin si insɛf na di sɛnt fɔ wan sofistikeyt atak. Di bad bad aktɔ dɛn kɔmprɔmis wan patikyula vɛshɔn tag (`v0.48.0`) insay in GitHub Akshɔn ripɔsitɔri, injɛkt kɔd we dɛn mek fɔ tif sɛnsitiv sikrit frɔm ɛni wokflɔ we yuz am. Dis tin we apin na wan stark mɛmba se insay wi intakɔnekt divɛlɔpmɛnt ɛkosistim, trɔst fɔ kɔntinyu fɔ chɛk, nɔto fɔ tek am.
Anatomi fɔ di Tag Kɔmprɔmis Atak
Dis nɔto bin fɔ brok Trivy in kɔr aplikeshɔn kɔd, bɔt na bin kleva sɔbvɛshɔn fɔ in CI/CD ɔtomɛshɔn. Di atak dɛn bin tɔch di GitHub Akshɔn ripɔsitɔri, ɛn mek wan bad bad vɛshɔn fɔ di `action.yml` fayl fɔ di `v0.48.0` tag. We wan divɛlɔpa in wokflɔ rɛfrɛns dis patikyula tag, di akshɔn go ɛksɛkutiv wan bad bad skript bifo i rɔn di lɛjitimɛnt Trivy skan. Dɛn bin mek dis skript fɔ pul sikrit dɛn—lɛk ripɔsitɔri token dɛn, klawd prɔvayda kredibiliti, ɛn API ki dɛn—to wan rimot sava we di pɔsin we atak de kɔntrol. Di insidious nature of dis atak lay in in spesifikiti; divɛlɔpa dɛn we de yuz di saf `@v0.48` ɔ `@main` tag dɛn nɔ bin afɛkt, bɔt di wan dɛn we pin di ɛksaktɔ kɔmprɔmis tag we dɛn nɔ bin no, bin introduks wan impɔtant vulnerability insay dɛn paip layn.
Wetin Mek Dis Insidɛnt de Rezɔna Akrays di DevOps Wɔl
Di Trivy kɔmprɔmis impɔtant fɔ sɔm rizin dɛn. Fɔs, Trivy na fawndeshɔnal sikyɔriti tul we bɔku bɔku pipul dɛn de yuz fɔ skan fɔ vulnerabilities insay kɔntena ɛn kɔd. Wan atak pan wan sikyɔriti tul de pwɛl di fawndeshɔn trɔst we dɛn nid fɔ mek sikyɔriti divɛlɔpmɛnt. Sɛkɔn, i de sho di tren we de gro we atak pipul dɛn de muv "ɔpstrim," we de tɔch di tul ɛn dipɛnsin dɛn we dɛn bil ɔda softwe pan. We dɛn pɔyzin wan kɔmpɔnɛnt we dɛn kin yuz bɔku bɔku wan, dɛn kin ebul fɔ gɛt akses to wan big nɛtwɔk we gɛt prɔjɛkt ɛn ɔganayzeshɔn dɛn we de dɔŋ di wata. Dis insidɛnt de sav as wan impɔtant kes stɔdi insay sapla chen sikyɔriti, we de sho se nɔ tul, ilɛksɛf i gɛt gud nem, nɔ gɛt fɔ yuz am as atak vektɔ.
"Dis atak de sho se dɛn ɔndastand di divɛlɔpa bihayvya ɛn CI/CD mɛkaniks. Fɔ pin to wan patikyula vɛshɔn tag dɛn kin tek am se na di bɛst prɔsis fɔ stebul, bɔt dis insidɛnt sho se i kin introduks risk bak if dɛn kɔmprɔmis da spɛshal vɛshɔn de. Di lɛsin na dat sikyɔriti na kɔntinyu prɔses, nɔto wan tɛm sɛtup."
we yu kin yuz
Stɛp dɛn we yu fɔ du wantɛm wantɛm fɔ mek yu sikyuɔr yu GitHub Akshɔn dɛn
In di we aw dis tin apin, divɛlɔpa ɛn sikyɔriti tim dɛn fɔ tek proaktiv mɛsej fɔ mek dɛn GitHub Akshɔn wokflɔ dɛn at. Fɔ fil satisfay na di ɛnimi fɔ sef. Na impɔtant step dɛn fɔ impruv am wantɛm wantɛm:
we dɛn kɔl
Yuz kɔmit SHA pinin instead ɔf tag: Ɔltɛm rɛfrɛns akshɔn dɛn bay dɛn ful kɔmit hash (e.g., `actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675`). Dis na di onli we fɔ garanti se yu de yuz wan immutable vɛshɔn fɔ di akshɔn.
Odit yu wokflɔ dɛn we yu de du naw: Skrutin yu `.github/workflows` dairektrɔ. Identify ɛni akshɔn we dɛn pin to tag ɛn swich dɛn fɔ kɔmit SHA, mɔ fɔ impɔtant sikyɔriti tul dɛn.
Leva GitHub in sikyɔriti ficha dɛn: Ɛnabul di stetɔs chɛk dɛn we dɛn nid ɛn rivyu di `workflow_permissions` sɛtin, sɛt dɛn to rid-onli bay difɔlt fɔ minimiz di pɔtɛnɛshɛl damej frɔm wan kɔmprɔmis akshɔn.
Wɛl fɔ mek yu sikyurɛt wan wan tul dɛn impɔtant, tru tru resiliɛns de kɔmɔt frɔm wan ɔlistik we fɔ yu biznɛs ɔpreshɔn. Insidɛnt dɛn lɛk di Trivy kɔmprɔmis de sho di hiden kɔmplisiti ɛn risk dɛn we de insay di mɔdan tulchen dɛn. Wan pletfɔm lɛk Mewayz adrɛs dis bay we i de gi wan yunifayd, modular biznɛs OS we de ridyus dipɛnsin sprawl ɛn sɛntralayz kɔntrol. Insted fɔ juggle wan duzin difrɛn savis dɛn—ɛvri wan wit in yon sikyɔriti mɔdel ɛn ɔpdet saykl—Mewayz de intagret kɔr fɛnshɔn dɛn lɛk prɔjek manejmɛnt, CRM, ɛn dɔkyumɛnt handlin insay wan, sikyɔriti ɛnvayrɔmɛnt. Dis kɔnsolidɛshɔn de minimiz di atak sɔfa ɛn simpul sikyɔriti gɔvmɛnt, alaw tim dɛn fɔ pe atɛnshɔn fɔ bil ficha dɛn pas fɔ patch vulnerabilities ɔltɛm na wan fragmɛnt softwe stak. Insay wan wɔl usay wan kɔmprɔmis tag kin mek big big brech, di intagreted sikyɔriti ɛn strimlayn ɔpreshɔn we Mewayz de gi de gi wan mɔ kɔntrol ɛn ɔditabl fawndeshɔn fɔ gro.
Trivy ɔnda atak bak: Widespread GitHub Akshɔn dɛn tag kɔmprɔmis sikrit
Di sikyɔriti fɔ di softwea sapɔt chen na jɔs lɛk aw i wik pas ɔl. Fɔ bɔku bɔku divɛlɔpmɛnt tim dɛn, da link de dɔn bi di sem tul dɛn we dɛn de abop pan fɔ fɛn vulnerabilities. Insay wan tin we bin de mɔna pipul dɛn, Trivy, we na wan pɔpul opin-sɔs vulnɛrabiliti skan we Aqua Security de mentɛn, bin si insɛf na di sɛnt fɔ wan sofistikeyt atak. Di bad bad aktɔ dɛn kɔmprɔmis wan patikyula vɛshɔn tag (`v0.48.0`) insay in GitHub Akshɔn ripɔsitɔri, injɛkt kɔd we dɛn mek fɔ tif sɛnsitiv sikrit frɔm ɛni wokflɔ we yuz am. Dis tin we apin na wan stark mɛmba se insay wi intakɔnekt divɛlɔpmɛnt ɛkosistim, trɔst fɔ kɔntinyu fɔ chɛk, nɔto fɔ tek am.
Anatomi fɔ di Tag Kɔmprɔmis Atak
Dis nɔto bin fɔ brok Trivy in kɔr aplikeshɔn kɔd, bɔt na bin kleva sɔbvɛshɔn fɔ in CI/CD ɔtomɛshɔn. Di atak dɛn bin tɔch di GitHub Akshɔn ripɔsitɔri, ɛn mek wan bad bad vɛshɔn fɔ di `action.yml` fayl fɔ di `v0.48.0` tag. We wan divɛlɔpa in wokflɔ rɛfrɛns dis patikyula tag, di akshɔn go ɛksɛkutiv wan bad bad skript bifo i rɔn di lɛjitimɛnt Trivy skan. Dɛn bin mek dis skript fɔ pul sikrit dɛn—lɛk ripɔsitɔri token dɛn, klawd prɔvayda kredibiliti, ɛn API ki dɛn—to wan rimot sava we di pɔsin we atak de kɔntrol. Di insidious nature of dis atak lay in in spesifikiti; divɛlɔpa dɛn we de yuz di saf `@v0.48` ɔ `@main` tag dɛn nɔ bin afɛkt, bɔt di wan dɛn we pin di ɛksaktɔ kɔmprɔmis tag we dɛn nɔ bin no, bin introduks wan impɔtant vulnerability insay dɛn paip layn.
Wetin Mek Dis Insidɛnt de Rezɔna Akrays di DevOps Wɔl
Di Trivy kɔmprɔmis impɔtant fɔ sɔm rizin dɛn. Fɔs, Trivy na fawndeshɔnal sikyɔriti tul we bɔku bɔku pipul dɛn de yuz fɔ skan fɔ vulnerabilities insay kɔntena ɛn kɔd. Wan atak pan wan sikyɔriti tul de pwɛl di fawndeshɔn trɔst we dɛn nid fɔ mek sikyɔriti divɛlɔpmɛnt. Sɛkɔn, i de sho di tren we de gro we atak pipul dɛn de muv "ɔpstrim," we de tɔch di tul ɛn dipɛnsin dɛn we dɛn bil ɔda softwe pan. We dɛn pɔyzin wan kɔmpɔnɛnt we dɛn kin yuz bɔku bɔku wan, dɛn kin ebul fɔ gɛt akses to wan big nɛtwɔk we gɛt prɔjɛkt ɛn ɔganayzeshɔn dɛn we de dɔŋ di wata. Dis insidɛnt de sav as wan impɔtant kes stɔdi insay sapla chen sikyɔriti, we de sho se nɔ tul, ilɛksɛf i gɛt gud nem, nɔ gɛt fɔ yuz am as atak vektɔ.
Stɛp dɛn we yu fɔ du wantɛm wantɛm fɔ mek yu sikyuɔr yu GitHub Akshɔn dɛn
In di we aw dis tin apin, divɛlɔpa ɛn sikyɔriti tim dɛn fɔ tek proaktiv mɛsej fɔ mek dɛn GitHub Akshɔn wokflɔ dɛn at. Fɔ fil satisfay na di ɛnimi fɔ sef. Na impɔtant step dɛn fɔ impruv am wantɛm wantɛm:
Bil wan Resilient Fawndeshɔn wit Mewayz
Wɛl fɔ mek yu sikyurɛt wan wan tul dɛn impɔtant, tru tru resiliɛns de kɔmɔt frɔm wan ɔlistik we fɔ yu biznɛs ɔpreshɔn. Insidɛnt dɛn lɛk di Trivy kɔmprɔmis de sho di hiden kɔmplisiti ɛn risk dɛn we de insay di mɔdan tulchen dɛn. Wan pletfɔm lɛk Mewayz adrɛs dis bay we i de gi wan yunifayd, modular biznɛs OS we de ridyus dipɛnsin sprawl ɛn sɛntralayz kɔntrol. Insted fɔ juggle wan duzin difrɛn savis dɛn—ɛvri wan wit in yon sikyɔriti mɔdel ɛn ɔpdet saykl—Mewayz de intagret kɔr fɛnshɔn dɛn lɛk prɔjek manejmɛnt, CRM, ɛn dɔkyumɛnt handlin insay wan, sikyɔriti ɛnvayrɔmɛnt. Dis kɔnsolidɛshɔn de minimiz di atak sɔfa ɛn simpul sikyɔriti gɔvmɛnt, alaw tim dɛn fɔ pe atɛnshɔn fɔ bil ficha dɛn pas fɔ patch vulnerabilities ɔltɛm na wan fragmɛnt softwe stak. Insay wan wɔl usay wan kɔmprɔmis tag kin mek big big brech, di intagreted sikyɔriti ɛn strimlayn ɔpreshɔn we Mewayz de gi de gi wan mɔ kɔntrol ɛn ɔditabl fawndeshɔn fɔ gro.
Bil Yu Biznɛs OS Tide
Frɔm frilansa to ɛjɛnshi, Mewayz de pawa 138,000+ biznɛs wit 208 intagreted modul. Start fri, ɔpgrɛd we yu de gro.
