Continuous Integration / Continuous Disaster by 0x57696c6c

CI/CD Foundations and Risk

Will Alexander, a Palo Alto Networks red teamer, introduces CI/CD as automated build, test, and delivery through ephemeral runners. He contrasts marketed security benefits with real supply-chain failures such as SolarWinds Orion backdooring, compromised npm packages, and trojanized CCleaner builds.

Attack Scenarios

Three assumed-breach exercises cover a poisoned Debian dependency in a GitLab pipeline, malicious VS Code extensions, and multi-pipeline compromise. In the first, a backdoored package on a Kubernetes runner establishes C2; hung jobs may alert developers because builds normally finish quickly.

Abusing Pipeline Tokens

CI job tokens authenticate to GitLab APIs with the pipeline owner’s permissions across all accessible repositories—not just the active project. While jobs run, attackers exfiltrated 400+ projects (~4.5 GB) using a tool called GitLabrador Retriever, illustrating over-permissive developer accounts.

Defensive Takeaways

Alexander closes with DevSecOps mitigations Palo Alto implements and broader supply-chain controls, framing CI/CD as high-impact terrain when humans introduce secrets, third-party code, or misconfigurations.