Let’s Hack a Pipeline: Shared Infrastructure

Matt CooperAugust 27, 2020Aug 27, 202008/27/20

Welcome back to Let's Hack a Pipeline. We've seen argument injection and source code stealing. This week, we'll wrap up the miniseries with Episode III: a Shared Infrastructure attack. One more time: security is a shared responsibility. The purpose of this series is to showcase some potential pitfalls to help you avoid them. The setup Let's...

Let’s Hack a Pipeline: Stealing Another Repo

Matt CooperAugust 25, 2020Aug 25, 202008/25/20

We're back with another Let's Hack a Pipeline. Last time, we saw how to create - and prevent - argument injection. In this episode, we'll look at how a malicious user could access source code they shouldn't see. Welcome to Episode II: Stealing Another Repo. (Episode III is now available, too!) As I said before: security is a shared ...

Let’s Hack a Pipeline: Argument Injection

Matt CooperAugust 21, 2020Aug 21, 202008/21/20

Welcome to Let's Hack a Pipeline! In this series of posts, we'll walk through some common security pitfalls when setting up Azure Pipelines. We don't really want to get hacked, so we'll also show off the mitigation. Episode I is titled Argument Injection. Episode II and Episode III are now also available. Preface on security A quick note ...