Don’t let GitHub be your weakest security link

No ratings

Presented at GrrCON Cyber Security Summit and Hacker Conference 2023 by

Nadav Noy

Cybercriminals are highly motivated to attack software supply chains due to the valuable targets they contain and the damaging multiplier effect they can inflict downstream. Unfortunately, these exploits are relatively easy earlier in the chain at the source code management (SCM) level, providing attackers with the low hanging fruit they’ve been looking for. Not good. We’ve seen too many companies fail to secure their GitHub environments, often without even knowing the kind of vulnerabilities attackers may be able to exploit. Without awareness, how can we expect companies to properly detect them? We aim to fix this. In our presentation, our speakers will tell the untold story the Artifact Poisoning vulnerability we found on Github Actions: (details available below) https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust These kinds of vulnerabilities allow attackers to execute malicious code in a privileged pipeline which can let an attacker access sensitive secrets, move laterally in the organization, and implement a backdoor. We don’t have to tell you why that’s a bad thing. By giving attendees the secret sauce of how we discovered these vulnerabilities, they’ll gain valuable insights into the common pitfalls and best practices for maintaining a secure posture in their organization.