Is This Your Pipe? Hijacking the Build Pipeline

Presented at DEF CON 22 (2014), Aug. 10, 2014, 3 p.m. (60 minutes)

As developers of the web, we rely on tools to automate building code, run tests, and even deploy services. What happens when we're too trusting of CI/CD pipelines? Credentials get exposed, hijacked, and re-purposed. We'll talk about how often and what happens when people leak public cloud credentials, how some are protecting themselves using encrypted secrets, how to bypass protections against leaking decrypted secrets and how to turn their Jenkins into your own butler. Come hijack credentials out of repositories, steal hidden and encrypted secrets using builds, and hijack infrastructure via their continuous deployment.

Presenters:

• Greg Anderson - Software Security Engineer,Rackspace
  Greg Anderson is a Software Security Engineer at Rackspace. He likes to find different ways to poke things and watch them fall over. Breaking things in automation over large scale server deployments is his forte. Twitter: @rgbkrk GitHub: rgbkrk
• Kyle Kelley - Developer Support Engineer, Rackspace
  Kyle Kelley writes software, sneaks in security tomfoolery, and dabbles in as many open source projects as possible. During the day he writes code, builds systems, and helps developers with APIs and SDKs, infrastructure design, and not hanging themselves in the clouds. On the side he does ops and dev work for various open source projects, including their build infrastructure and public facing sites. He loves strange bugs.

Links:

• https://defcon.org/html/defcon-22/dc-22-speakers.html#Kelley
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Kyle Kelley & Greg Anderson - Is This Your Pipe.. Hijacking the Build Pipeline - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Kyle Kelley & Greg Anderson - Is This Your Pipe.. Hijacking the Build Pipeline - Video.mp4
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Kyle Kelley & Greg Anderson - Is This Your Pipe.. Hijacking the Build Pipeline - Slides.srt (subtitles)
• https://www.youtube.com/watch?v=nBR7Kru6JX0

Similar Presentations:

• BSidesLV 2023 / Are your secrets safe - How mobile applications are leaking millions of credentials
• BSidesLV 2023 / The attackers guide to exploiting secrets in the universe
• May Contain Hackers (MCH2022) / A story on how to reach ZERO exposed credentials in your organization