Securing the Pipeline: Protecting Self-Hosted GitHub Runners
summary
Compromise of a single developer personal access token lets an attacker push a malicious workflow to repos that run on self-hosted runners, spin a detached Docker implant, persist in the network, steal workflow secrets and escalate to prod cloud accounts — a red team used the open‑source GATO toolkit to do exactly that during assessments and repeatedly finds self-hosted runners insecure. Gaps include unlogged API reads and classic tokens; recommended fixes are fine-grained tokens, SAML SSO, centralized audit ingestion and ephemeral runners plus EDR.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 1:14GitHub Actions risks
- 21:28Mitigation strategies
- 28:08Supply chain security
- 28:26Advanced threats and detection
- 46:28Q&A and concluding remarks
related talks
36mGithub Actions Security Landscape
28mPwning the CI (with GitHub Action Workflows)
45mGitHub Actions & Security
42mProtecting CI/CD from malicious deploys
35mPwning the CI (GitHub Actions Edition)
21mSecurity That Enables: Breaking Down Security Silos in the DevOps Ecosystem
57mGitHub Actions: Vulnerabilities, Attacks, and Counter-measures
23mBreaking the Build: How Attackers Abuse GitHub Actions