TeamPCP駭客透過Trivy供應鏈攻擊入侵Aqua GitHub

🔑 增強重點摘要

• •The breach involved the unauthorized injection of malicious code into a specific Trivy build pipeline, which allowed the attackers to pivot from the open-source project to Aqua Security's internal corporate GitHub environment.
• •Security researchers identified that the attackers utilized a sophisticated 'dependency confusion' technique combined with a compromised developer token to bypass multi-factor authentication (MFA) protocols.
• •Aqua Security has initiated a mandatory rotation of all internal secrets and is currently conducting a forensic audit of all third-party dependencies integrated into their CI/CD pipelines to prevent recurrence.

🛠️ 技術深入

• •Attack Vector: Exploitation of a misconfigured GitHub Action workflow that lacked 'environment protection rules' for secrets access.
• •Persistence Mechanism: The attackers deployed a custom malicious GitHub App with elevated permissions, allowing them to maintain access even after the initial compromised developer token was revoked.
• •Data Exfiltration: The breach resulted in the unauthorized cloning of several private repositories containing internal infrastructure-as-code (IaC) templates and configuration scripts.
• •Detection Gap: The malicious activity was initially masked by legitimate automated build traffic, delaying detection by the Security Operations Center (SOC) for approximately 48 hours.

🔮 前景展望基於引用來源的 AI 分析

⏳ 時間線