Continuous Integration, Continuous Compromise

No ratings

Presented at BSidesVancouver 2017 by

If you work in the software industry, chances are you're familiar with build systems. Modern build systems make use of techniques such as Continuous Integration (CI) and Continuous Deployment (CD). This talk will cover how these systems can be the ideal location to gain a foothold into a network, and further, how they can be abused to add backdoors to otherwise secure code. Some of the most common systems will be examined (Jenkins, TeamCity, and Bamboo), but the techniques covered will apply to all build environments. These techniques are useful when penetration testing, but they're just as useful to understand if you have the burden of trying to set up or secure a build system.