1
00:00:00,960 --> 00:00:03,040
our next set of speakers

2
00:00:03,040 --> 00:00:06,160
here from NTT Communications they'll be

3
00:00:06,160 --> 00:00:07,879
speaking today on the potential for

4
00:00:07,879 --> 00:00:10,000
attacks leveraging GitHub actions and

5
00:00:10,000 --> 00:00:12,160
the title of their talk is the dark

6
00:00:12,160 --> 00:00:14,879
playground of cicd attack delivery by

7
00:00:14,879 --> 00:00:18,680
GitHub actions please welcome you

8
00:00:22,920 --> 00:00:27,000
SK thank you for introduction H everyone

9
00:00:27,000 --> 00:00:29,199
today we talk about techniques related

10
00:00:29,199 --> 00:00:30,880
to guitar

11
00:00:30,880 --> 00:00:34,399
so our main topic is sh security so I

12
00:00:34,399 --> 00:00:37,120
hope it will be useful useful and

13
00:00:37,120 --> 00:00:40,839
exciting for k

14
00:00:50,280 --> 00:00:53,359
Community First let me tell you about us

15
00:00:53,359 --> 00:00:54,879
I'm y

16
00:00:54,879 --> 00:00:58,199
Ando we are from Japan work for n

17
00:00:58,199 --> 00:01:00,640
Communications Japan Communication

18
00:01:00,640 --> 00:01:03,719
company we we work as offensive security

19
00:01:03,719 --> 00:01:05,640
researcher and sometimes work as

20
00:01:05,640 --> 00:01:08,159
internal

21
00:01:08,200 --> 00:01:11,200
regim this is our presentation agenda

22
00:01:11,200 --> 00:01:14,119
our talk goes like

23
00:01:14,119 --> 00:01:18,840
this first we talk about basics of Gab

24
00:01:18,840 --> 00:01:22,079
actions GitHub action is a shd platform

25
00:01:22,079 --> 00:01:25,560
provided by GitHub that AR to automate

26
00:01:25,560 --> 00:01:29,439
build test and de deployment Pipeline

27
00:01:29,439 --> 00:01:31,240
and this is is a component of guitar

28
00:01:31,240 --> 00:01:35,520
action there are sometimes event R job

29
00:01:35,520 --> 00:01:37,799
and action in our

30
00:01:37,799 --> 00:01:40,799
presentation and action are important so

31
00:01:40,799 --> 00:01:44,560
I will explain a little more

32
00:01:50,799 --> 00:01:53,920
detail there are two types of run guitar

33
00:01:53,920 --> 00:01:57,880
potit and H in short the difference that

34
00:01:57,880 --> 00:01:58,840
resource

35
00:01:58,840 --> 00:02:02,280
owner hosted run with resource provided

36
00:02:02,280 --> 00:02:06,680
by GitHub and hosted run with resource

37
00:02:06,680 --> 00:02:10,080
and provided by user L supports some of

38
00:02:10,080 --> 00:02:13,879
operating system Macos Linux windows but

39
00:02:13,879 --> 00:02:17,399
our research focus on

40
00:02:18,400 --> 00:02:21,040
Windows next let's look at custom

41
00:02:21,040 --> 00:02:24,200
actions actions are immed tasks in the

42
00:02:24,200 --> 00:02:27,280
workflow we can use a combination of

43
00:02:27,280 --> 00:02:30,640
action to suit our purpose

44
00:02:30,640 --> 00:02:33,599
and we can also create and publish own

45
00:02:33,599 --> 00:02:35,879
actions in the guitar

46
00:02:35,879 --> 00:02:39,000
Marketplace there are different types of

47
00:02:39,000 --> 00:02:41,800
action custom action three types are

48
00:02:41,800 --> 00:02:44,959
available but we but we have targeted

49
00:02:44,959 --> 00:02:47,640
JavaScript action and composite action

50
00:02:47,640 --> 00:02:50,279
that support

51
00:02:50,640 --> 00:02:54,040
Windows so much for the basics and deep

52
00:02:54,040 --> 00:02:57,120
dive into the main

53
00:02:57,200 --> 00:03:00,000
contents at the beginning of the

54
00:03:00,000 --> 00:03:02,280
research we analyze the behavior of

55
00:03:02,280 --> 00:03:03,440
JavaScript

56
00:03:03,440 --> 00:03:08,239
action the figure is pariz visualized

57
00:03:08,239 --> 00:03:11,760
process Behavior as you can see Runner

58
00:03:11,760 --> 00:03:17,000
worker X execute no X and gives index.js

59
00:03:17,000 --> 00:03:17,840
as

60
00:03:17,840 --> 00:03:21,159
argument this index.js is defined as

61
00:03:21,159 --> 00:03:25,040
enter point in the action metadata file

62
00:03:25,040 --> 00:03:28,519
and the script no is included in the

63
00:03:28,519 --> 00:03:31,120
runner application

64
00:03:31,120 --> 00:03:34,239
package observing this behavior and

65
00:03:34,239 --> 00:03:39,040
specification we produce new attack

66
00:03:39,879 --> 00:03:43,000
techniques what do you thing of when you

67
00:03:43,000 --> 00:03:46,879
hear the JavaScript in general it is the

68
00:03:46,879 --> 00:03:49,840
script language the qu technology of the

69
00:03:49,840 --> 00:03:53,120
worldwide web on the other hand some may

70
00:03:53,120 --> 00:03:54,360
think of

71
00:03:54,360 --> 00:03:57,280
jscript implemented by

72
00:03:57,280 --> 00:04:00,040
Microsoft there is a basic comp

73
00:04:00,040 --> 00:04:03,319
compatibility but jscript and JavaScript

74
00:04:03,319 --> 00:04:04,480
are

75
00:04:04,480 --> 00:04:07,280
different our research focused on both

76
00:04:07,280 --> 00:04:10,079
jscript and JavaScript I mean be

77
00:04:10,079 --> 00:04:14,200
considered the two techniques for

78
00:04:14,640 --> 00:04:17,560
each first we introduce the jscript

79
00:04:17,560 --> 00:04:20,478
version we call this technique mishas

80
00:04:20,478 --> 00:04:23,479
jscript custom action this is a

81
00:04:23,479 --> 00:04:26,160
technique for executing jscript from

82
00:04:26,160 --> 00:04:28,800
JavaScript custom action we are binary

83
00:04:28,800 --> 00:04:31,039
hijacking and

84
00:04:31,039 --> 00:04:33,360
masquerading here is the overview of

85
00:04:33,360 --> 00:04:37,400
this technique for attack that prepare

86
00:04:37,400 --> 00:04:41,280
work and custom action like this the the

87
00:04:41,280 --> 00:04:45,039
work has two step First Step rep the

88
00:04:45,039 --> 00:04:48,440
binary and second step execut a custom

89
00:04:48,440 --> 00:04:51,960
action this custom action is implemented

90
00:04:51,960 --> 00:04:54,919
in jscript not

91
00:04:54,919 --> 00:04:57,440
JavaScript the behavior of the end point

92
00:04:57,440 --> 00:05:00,080
when the work is ex executed

93
00:05:00,080 --> 00:05:02,120
is showing the right

94
00:05:02,120 --> 00:05:09,120
figure copy wrip X to X and index.js is

95
00:05:09,120 --> 00:05:10,880
executed

96
00:05:10,880 --> 00:05:13,880
from

97
00:05:15,600 --> 00:05:19,400
X we here by at composite action this

98
00:05:19,400 --> 00:05:22,360
one allows us to bundle multiple steps

99
00:05:22,360 --> 00:05:23,880
into one

100
00:05:23,880 --> 00:05:27,240
action the figure on this right shows

101
00:05:27,240 --> 00:05:29,960
how it changes with and with that

102
00:05:29,960 --> 00:05:32,840
composite action with composite action

103
00:05:32,840 --> 00:05:35,759
case the worklow is Consolidated into a

104
00:05:35,759 --> 00:05:36,919
single

105
00:05:36,919 --> 00:05:41,240
step and these two steps are defined in

106
00:05:41,240 --> 00:05:44,919
the composite action I'll explain

107
00:05:44,919 --> 00:05:50,198
later L why we combine composite

108
00:05:50,800 --> 00:05:53,919
diretion finally the JavaScript custom

109
00:05:53,919 --> 00:05:55,960
action combined with a composite action

110
00:05:55,960 --> 00:05:59,560
look like this we call this technique as

111
00:05:59,560 --> 00:06:03,319
Misha jscript composite

112
00:06:04,440 --> 00:06:08,039
action and here is a actual PO Code we

113
00:06:08,039 --> 00:06:12,560
develop the V calls C composite action

114
00:06:12,560 --> 00:06:16,599
and composite action copies d x in step

115
00:06:16,599 --> 00:06:20,520
one and C custom action in step

116
00:06:20,520 --> 00:06:24,080
two then index of JS is executed from

117
00:06:24,080 --> 00:06:26,758
the custom

118
00:06:27,199 --> 00:06:31,039
action index.js is written in jscript in

119
00:06:31,039 --> 00:06:33,599
which attack is

120
00:06:33,599 --> 00:06:36,280
implemented attacker canitar attack by

121
00:06:36,280 --> 00:06:39,679
changing the jscript

122
00:06:41,520 --> 00:06:43,840
implementation I have a quick demo of

123
00:06:43,840 --> 00:06:45,560
infecting

124
00:06:45,560 --> 00:06:50,599
citu from this technique let me show

125
00:06:58,400 --> 00:07:00,440
you

126
00:07:00,440 --> 00:07:03,280
the left side attack point of view and

127
00:07:03,280 --> 00:07:07,039
right side the victim point of view run

128
00:07:07,039 --> 00:07:10,479
application is already running get push

129
00:07:10,479 --> 00:07:14,440
to GitHub to to the

130
00:07:15,639 --> 00:07:21,400
event then you will see work R uh

131
00:07:21,400 --> 00:07:25,039
starts and some child process that's

132
00:07:25,039 --> 00:07:27,560
also work

133
00:07:28,319 --> 00:07:31,319
out

134
00:07:34,560 --> 00:07:38,720
finally is she connection is

135
00:07:40,680 --> 00:07:43,599
established at the end of the work work

136
00:07:43,599 --> 00:07:46,400
X and child process is

137
00:07:46,400 --> 00:07:51,680
terminated and X is shet process uh it

138
00:07:51,680 --> 00:07:55,199
is started by AR injection and PP dising

139
00:07:55,199 --> 00:07:56,360
from run

140
00:07:56,360 --> 00:07:58,919
application we implemented some

141
00:07:58,919 --> 00:08:02,359
injection technique in

142
00:08:05,800 --> 00:08:08,319
jscript so far I have talked about

143
00:08:08,319 --> 00:08:11,520
jscript version next I will describe

144
00:08:11,520 --> 00:08:14,639
JavaScript version we have discovered

145
00:08:14,639 --> 00:08:17,639
attack techniques that exploits noj

146
00:08:17,639 --> 00:08:20,879
extension noj has extension called

147
00:08:20,879 --> 00:08:24,759
shiper Ador this one can be used for

148
00:08:24,759 --> 00:08:27,759
attack uh we call this technique mous

149
00:08:27,759 --> 00:08:30,800
Javas JavaScript C

150
00:08:30,800 --> 00:08:33,440
action there's a package called memory

151
00:08:33,440 --> 00:08:36,679
JS this is not for the hacking it is a

152
00:08:36,679 --> 00:08:40,479
legitimate package but for haer like us

153
00:08:40,479 --> 00:08:43,360
there are useful function available like

154
00:08:43,360 --> 00:08:47,040
open process and injecta so we use this

155
00:08:47,040 --> 00:08:50,599
library in our

156
00:08:51,080 --> 00:08:54,760
Pok also here is the act po we develop

157
00:08:54,760 --> 00:08:58,680
the work C custom action and this custom

158
00:08:58,680 --> 00:09:01,839
action includes simple D and not module

159
00:09:01,839 --> 00:09:03,279
for the

160
00:09:03,279 --> 00:09:06,680
attack index.js is implemented in

161
00:09:06,680 --> 00:09:09,200
JavaScript and it's designed to perform

162
00:09:09,200 --> 00:09:12,600
Dr injection using memory JS

163
00:09:12,600 --> 00:09:16,160
function open process and inject inject

164
00:09:16,160 --> 00:09:18,800
area are already implemented in memory

165
00:09:18,800 --> 00:09:22,800
JS so JavaScript code is very

166
00:09:22,800 --> 00:09:26,360
simple we use memory J in this in this

167
00:09:26,360 --> 00:09:29,640
research but we can Implement on ship on

168
00:09:29,640 --> 00:09:31,640
for arbitary

169
00:09:31,640 --> 00:09:34,560
attacks so unfortunately there there

170
00:09:34,560 --> 00:09:36,760
will be no demonstration

171
00:09:36,760 --> 00:09:40,040
today uh but maybe talk to me later and

172
00:09:40,040 --> 00:09:43,120
I'll show you the

173
00:09:43,399 --> 00:09:47,120
them so as my final part I talk about

174
00:09:47,120 --> 00:09:48,079
some

175
00:09:48,079 --> 00:09:50,440
considerations first let's discuss the

176
00:09:50,440 --> 00:09:51,560
attack

177
00:09:51,560 --> 00:09:54,600
scenario marisha's action desguised as

178
00:09:54,600 --> 00:09:56,920
legitimate action could be published in

179
00:09:56,920 --> 00:10:00,360
the marketplace by attacker

180
00:10:00,360 --> 00:10:03,160
then users May mistakenly use a mous

181
00:10:03,160 --> 00:10:06,399
action thinking it is a legitimate

182
00:10:06,399 --> 00:10:09,600
action all users of guitar guitar

183
00:10:09,600 --> 00:10:12,880
actions are potential victims so this is

184
00:10:12,880 --> 00:10:15,600
a very big

185
00:10:17,160 --> 00:10:20,560
thre composite action makes this threat

186
00:10:20,560 --> 00:10:21,519
as

187
00:10:21,519 --> 00:10:24,800
realistic with that composite action

188
00:10:24,800 --> 00:10:29,800
Step One is required but who set up this

189
00:10:29,800 --> 00:10:32,600
even if users accidentally use the fake

190
00:10:32,600 --> 00:10:35,079
action but they will not accidentally

191
00:10:35,079 --> 00:10:36,240
set step

192
00:10:36,240 --> 00:10:40,760
one so aggregating steps in com

193
00:10:40,760 --> 00:10:42,959
composite action is very important for

194
00:10:42,959 --> 00:10:45,160
the

195
00:10:46,320 --> 00:10:50,040
attacker it can also expand the attack

196
00:10:50,040 --> 00:10:52,399
possibilities in advanced

197
00:10:52,399 --> 00:10:55,800
technique man application tracks R Char

198
00:10:55,800 --> 00:10:58,240
process and kill all Char process when

199
00:10:58,240 --> 00:10:59,720
the workow is is

200
00:10:59,720 --> 00:11:02,839
finished and this mean that the process

201
00:11:02,839 --> 00:11:06,320
R for theack will also be

202
00:11:06,320 --> 00:11:09,360
CED it is tracked by process

203
00:11:09,360 --> 00:11:11,360
environmental variable called Runner

204
00:11:11,360 --> 00:11:14,399
tracking ID so we can disable tracking

205
00:11:14,399 --> 00:11:18,120
by reating this variable uh like

206
00:11:18,120 --> 00:11:22,360
this this makes the process

207
00:11:22,360 --> 00:11:25,360
persistent by the way process R form the

208
00:11:25,360 --> 00:11:28,320
application have characteristic variable

209
00:11:28,320 --> 00:11:32,240
uh so perhap they can be used for

210
00:11:33,760 --> 00:11:36,680
detection next let's consider how to

211
00:11:36,680 --> 00:11:38,120
protect

212
00:11:38,120 --> 00:11:41,519
it GitHub recognize these attacks as

213
00:11:41,519 --> 00:11:43,720
threat and publish best

214
00:11:43,720 --> 00:11:47,920
practice basically it says that it is

215
00:11:47,920 --> 00:11:52,040
important to audit the code and the

216
00:11:53,880 --> 00:11:57,000
creators of course it can be detected by

217
00:11:57,000 --> 00:12:00,959
Security Solutions like Ed

218
00:12:01,519 --> 00:12:04,040
script composite action is detected by

219
00:12:04,040 --> 00:12:07,160
ADR for defense via

220
00:12:07,160 --> 00:12:09,240
mascar this is

221
00:12:09,240 --> 00:12:12,040
unchangeable part of this technique so

222
00:12:12,040 --> 00:12:15,399
it is a good detection

223
00:12:15,560 --> 00:12:19,920
point also js5 is sometimes detected by

224
00:12:19,920 --> 00:12:22,600
antivirus however this is not effective

225
00:12:22,600 --> 00:12:26,120
because it can be easily

226
00:12:26,760 --> 00:12:29,480
bypassed like this right with a few

227
00:12:29,480 --> 00:12:31,880
changes it is easy to bypass of

228
00:12:31,880 --> 00:12:36,880
detection so anti virus is not ative

229
00:12:38,440 --> 00:12:41,279
measure detecting maras JavaScript

230
00:12:41,279 --> 00:12:44,040
custom action is a bit more difficult

231
00:12:44,040 --> 00:12:46,480
because this technique does not require

232
00:12:46,480 --> 00:12:49,480
to replace the script engine so there is

233
00:12:49,480 --> 00:12:52,680
one L detection point we think it is

234
00:12:52,680 --> 00:12:55,399
import to detect the attack Behavior

235
00:12:55,399 --> 00:13:00,519
being carrier not this technique itself

236
00:13:00,519 --> 00:13:03,240
and this technique may also be effective

237
00:13:03,240 --> 00:13:07,120
against amsi from our quick analysis it

238
00:13:07,120 --> 00:13:10,240
appears that no no there does not

239
00:13:10,240 --> 00:13:12,680
support

240
00:13:14,880 --> 00:13:18,320
MSI so in my part uh let me introduce

241
00:13:18,320 --> 00:13:21,079
GitHub action

242
00:13:21,600 --> 00:13:25,800
C2 gith action C2 is implemented by

243
00:13:25,800 --> 00:13:28,880
utilizing D actions run application as

244
00:13:28,880 --> 00:13:29,959
agent

245
00:13:29,959 --> 00:13:33,079
she this is an abstruct image of GitHub

246
00:13:33,079 --> 00:13:33,880
action

247
00:13:33,880 --> 00:13:37,399
C2 the runner application runs on target

248
00:13:37,399 --> 00:13:40,160
machine connecting to

249
00:13:40,160 --> 00:13:45,519
the the GitHub especially attacker only

250
00:13:45,519 --> 00:13:48,560
repository this connection becomes

251
00:13:48,560 --> 00:13:52,959
C2 to operate this attack attacker PES a

252
00:13:52,959 --> 00:13:56,480
marous configuration file outside

253
00:13:56,480 --> 00:13:59,320
GitHub this GitHub has two

254
00:13:59,320 --> 00:14:02,839
features firstly The Source process is

255
00:14:02,839 --> 00:14:05,839
reestimate application

256
00:14:05,839 --> 00:14:08,440
runx and the second point is that the

257
00:14:08,440 --> 00:14:12,759
destination is res domain and

258
00:14:14,639 --> 00:14:17,800
ID so how to establish

259
00:14:17,800 --> 00:14:21,360
C2 so as officially uh as officially

260
00:14:21,360 --> 00:14:24,600
stated Runner application when launched

261
00:14:24,600 --> 00:14:27,440
performs a wrong ping against GitHub

262
00:14:27,440 --> 00:14:29,279
GitHub to AO

263
00:14:29,279 --> 00:14:34,120
jobs to manage run as a c agent as

264
00:14:34,120 --> 00:14:36,600
assigning a unique level is

265
00:14:36,600 --> 00:14:40,800
needed this allows attacker uh this arow

266
00:14:40,800 --> 00:14:43,680
attackers to send command individually

267
00:14:43,680 --> 00:14:45,920
when establish the two connections

268
00:14:45,920 --> 00:14:49,120
within with marchall Target with a

269
00:14:49,120 --> 00:14:51,680
trouble attacker end up sending same

270
00:14:51,680 --> 00:14:55,279
commands to all connecting

271
00:14:57,440 --> 00:15:01,720
host how to send command ini sh commands

272
00:15:01,720 --> 00:15:06,120
can be executed via GitHub actions

273
00:15:06,120 --> 00:15:09,440
workfl workflow jobs are described in

274
00:15:09,440 --> 00:15:12,120
configuration file on attack

275
00:15:12,120 --> 00:15:15,199
repository we can trigger workflow by

276
00:15:15,199 --> 00:15:18,959
actions like push and in this case we

277
00:15:18,959 --> 00:15:23,680
use a web hook event called repository

278
00:15:23,680 --> 00:15:26,720
dispatch we can call this event using a

279
00:15:26,720 --> 00:15:29,600
car and while passing instruction from

280
00:15:29,600 --> 00:15:31,040
outside

281
00:15:31,040 --> 00:15:34,759
GitHub plus using just introduce mous

282
00:15:34,759 --> 00:15:37,519
custom actions more Advan attack can

283
00:15:37,519 --> 00:15:40,000
also be

284
00:15:41,480 --> 00:15:43,920
performed I will show you short demo to

285
00:15:43,920 --> 00:15:46,800
make it easier to

286
00:15:48,360 --> 00:15:52,040
image biging runs application run

287
00:15:52,040 --> 00:15:56,120
application andap send a command to run

288
00:15:56,120 --> 00:15:57,600
calculation

289
00:15:57,600 --> 00:16:00,160
a

290
00:16:00,160 --> 00:16:03,680
and the victim machine coration exit was

291
00:16:03,680 --> 00:16:07,360
launched and after that you can see that

292
00:16:07,360 --> 00:16:12,959
also the P result on the top

293
00:16:16,560 --> 00:16:20,040
side attack scenario so attack scenario

294
00:16:20,040 --> 00:16:24,040
is almost the same as other C2 so F

295
00:16:24,040 --> 00:16:27,279
attacker create a public repository for

296
00:16:27,279 --> 00:16:30,199
attacks and then attacker send the run

297
00:16:30,199 --> 00:16:33,000
application to Target uh using

298
00:16:33,000 --> 00:16:35,199
techniques such as

299
00:16:35,199 --> 00:16:38,079
faing after that the target

300
00:16:38,079 --> 00:16:44,519
user no runs runs it as showing the

301
00:16:46,639 --> 00:16:48,519
demo about

302
00:16:48,519 --> 00:16:51,839
detections so uh since sour process and

303
00:16:51,839 --> 00:16:55,199
the destination domain is resting it uh

304
00:16:55,199 --> 00:16:58,519
C establishment is hard to detect so

305
00:16:58,519 --> 00:17:01,319
it's very ordinary way but uh don't miss

306
00:17:01,319 --> 00:17:03,680
a lot for activities related to GitHub

307
00:17:03,680 --> 00:17:06,760
actions C2 and and just because they

308
00:17:06,760 --> 00:17:09,319
seem to be

309
00:17:12,039 --> 00:17:14,959
resident last part is other thread

310
00:17:14,959 --> 00:17:18,079
related to GitHub options I will briefly

311
00:17:18,079 --> 00:17:21,159
introduce three

312
00:17:22,720 --> 00:17:25,919
threads firstly free jacking free

313
00:17:25,919 --> 00:17:29,080
jacking is a process of using free Cloud

314
00:17:29,080 --> 00:17:32,140
resources to perform crypto mining

315
00:17:32,140 --> 00:17:33,320
[Music]

316
00:17:33,320 --> 00:17:37,120
operations attack execute mining code M

317
00:17:37,120 --> 00:17:39,080
script using gab

318
00:17:39,080 --> 00:17:41,840
resources and the after that the

319
00:17:41,840 --> 00:17:44,918
attacker can get a

320
00:17:46,440 --> 00:17:50,679
reward to utilize G have resources the

321
00:17:50,679 --> 00:17:53,559
attackers and P request have mining cord

322
00:17:53,559 --> 00:17:55,159
to run other

323
00:17:55,159 --> 00:17:58,360
repositories more uh more precisely for

324
00:17:58,360 --> 00:18:01,159
fing a public repository and embedding

325
00:18:01,159 --> 00:18:04,000
mining C into actions and sending

326
00:18:04,000 --> 00:18:08,760
request trigger mining using

327
00:18:08,760 --> 00:18:12,799
resources but to prevent this to prevent

328
00:18:12,799 --> 00:18:16,320
this uh GitHub change specification and

329
00:18:16,320 --> 00:18:19,000
approval have been required to run work

330
00:18:19,000 --> 00:18:22,039
for uh from work uh from public Forks

331
00:18:22,039 --> 00:18:24,080
since April

332
00:18:24,080 --> 00:18:28,600
2021 so attaka have safed their focus to

333
00:18:28,600 --> 00:18:31,480
automatically creating g account

334
00:18:31,480 --> 00:18:36,360
executing G actions and exploiting their

335
00:18:38,960 --> 00:18:42,919
resources secondly Mia's fabri folks

336
00:18:42,919 --> 00:18:47,559
fork and request the the idea is that uh

337
00:18:47,559 --> 00:18:50,120
if a selfhosted runner is being used

338
00:18:50,120 --> 00:18:52,918
with a public

339
00:18:53,240 --> 00:18:57,200
repository uh the have aution may become

340
00:18:57,200 --> 00:19:01,240
uh potential entry point for external uh

341
00:19:01,240 --> 00:19:04,799
external attack to gain initial

342
00:19:04,799 --> 00:19:08,200
footfall this uh this may a attacker

343
00:19:08,200 --> 00:19:12,080
execute their code on the target

344
00:19:12,080 --> 00:19:15,080
machine so GitHub is aware of this

345
00:19:15,080 --> 00:19:18,720
threat and recommended that using S hos

346
00:19:18,720 --> 00:19:22,520
run only for private repository however

347
00:19:22,520 --> 00:19:24,159
uh it's worth noting that there are

348
00:19:24,159 --> 00:19:26,360
numerous organizations still utilize the

349
00:19:26,360 --> 00:19:29,000
hostd runner in public Repository

350
00:19:29,000 --> 00:19:32,320
so there are to available for exploring

351
00:19:32,320 --> 00:19:35,400
public repository for uh that you self

352
00:19:35,400 --> 00:19:37,679
use self hosted Runner and the

353
00:19:37,679 --> 00:19:41,200
investigation are planed to access the

354
00:19:41,200 --> 00:19:44,000
ACT actual

355
00:19:44,600 --> 00:19:49,480
situation lastly steering secret so GI

356
00:19:49,480 --> 00:19:51,520
provides a feature to create encrypt

357
00:19:51,520 --> 00:19:54,280
environment variable called secret as

358
00:19:54,280 --> 00:19:56,400
organization were

359
00:19:56,400 --> 00:19:59,679
reposable so Secret can be accessed by

360
00:19:59,679 --> 00:20:01,440
accessed by GitHub actions when they are

361
00:20:01,440 --> 00:20:02,799
set up for the

362
00:20:02,799 --> 00:20:06,720
repository so this POS potential isk uh

363
00:20:06,720 --> 00:20:09,960
secret being stolen if attacker accessed

364
00:20:09,960 --> 00:20:13,400
by exter by if attacker can access the

365
00:20:13,400 --> 00:20:17,000
the secret through the GitHub

366
00:20:19,000 --> 00:20:22,360
actions so I end here I ended up here

367
00:20:22,360 --> 00:20:24,520
conclusion that there are three point

368
00:20:24,520 --> 00:20:26,919
firstly by utilizing the feature offered

369
00:20:26,919 --> 00:20:29,799
by cscd so such as a command and uh

370
00:20:29,799 --> 00:20:32,559
script execution it's possible to launch

371
00:20:32,559 --> 00:20:35,679
a talk within the legitimate cicd

372
00:20:35,679 --> 00:20:38,919
process and second is a maras code May

373
00:20:38,919 --> 00:20:41,280
infiltrate a pipeline without notice

374
00:20:41,280 --> 00:20:43,919
through a publicly available maras pling

375
00:20:43,919 --> 00:20:46,559
we introduce this as a mous custom

376
00:20:46,559 --> 00:20:48,840
action and the last point is that

377
00:20:48,840 --> 00:20:50,960
there's a risk of enabling C2 through

378
00:20:50,960 --> 00:20:55,000
the res feature by uh offered by CCD uh

379
00:20:55,000 --> 00:20:57,200
which are the user own post for

380
00:20:57,200 --> 00:21:00,120
executing

381
00:21:00,559 --> 00:21:03,640
task so for future work uh we are

382
00:21:03,640 --> 00:21:08,320
starting focusing on uh other cic

383
00:21:08,320 --> 00:21:11,200
platform so thank you for security uh

384
00:21:11,200 --> 00:21:12,840
GitHub Action Security team for

385
00:21:12,840 --> 00:21:15,720
cooporation and also thank for um croud

386
00:21:15,720 --> 00:21:18,440
village team uh for accepting our talk

387
00:21:18,440 --> 00:21:20,640
thank

388
00:21:27,039 --> 00:21:30,039
you

389
00:21:30,279 --> 00:21:33,600
question oh yeah yeah and do you have

390
00:21:33,600 --> 00:21:35,879
any

391
00:21:37,279 --> 00:21:39,320
questions do you want to do questions

392
00:21:39,320 --> 00:21:41,360
out back or up front Okay you want to do

393
00:21:41,360 --> 00:21:45,879
them here or out there uh try to here

394
00:21:47,360 --> 00:21:54,240
here so the is the same is it just as uh

395
00:21:54,240 --> 00:21:56,279
diff or just as easy if you're not using

396
00:21:56,279 --> 00:21:59,480
Windows as a Target or is it more

397
00:21:59,480 --> 00:22:02,440
difficult Target on Windows yeah so I

398
00:22:02,440 --> 00:22:04,840
see i s a lot of Target on Windows there

399
00:22:04,840 --> 00:22:08,360
yeah is it does Linx share the same

400
00:22:08,360 --> 00:22:10,720
vulnerabilities or you is it safer by

401
00:22:10,720 --> 00:22:15,080
default because it's not Windows and J

402
00:22:15,080 --> 00:22:21,720
script uh so sorry so could you say

403
00:22:21,720 --> 00:22:23,000
again

404
00:22:23,000 --> 00:22:27,360
yeah is the same attack Vector as viable

405
00:22:27,360 --> 00:22:31,480
in a non Windows environment yeah

406
00:22:31,480 --> 00:22:33,960
uh

407
00:22:33,960 --> 00:22:36,360
yeah so about for

408
00:22:36,360 --> 00:22:40,960
jpt yeah because jpt is to be only yeah

409
00:22:40,960 --> 00:22:47,080
yes and also as for Action C2 so there

410
00:22:47,080 --> 00:22:50,679
host run for relx so so it works okay

411
00:22:50,679 --> 00:22:54,039
right yeah thank you thank

412
00:22:54,039 --> 00:22:57,039
you