How hackers can breach your C.I / C.D systems
summary
Concrete exploits and working demos show how CI/CD tooling actually fails: Jenkins agents run a reverse shell via netcat; GitHub Actions and third‑party actions can exfiltrate secrets (Codecov‑style); pipelines download and execute arbitrary binaries, enabling an evil agent/zombie; Docker Hub publishes images containing credentials and secrets found in Docker images; zip/war bombs and a memory/fork bomb demo take down agents and cluster masters. Mitigations emphasized: protected variables, restricted internet for agents, per‑task service accounts, hardened artifact registries and resource limits.
AI-written summary · about
chapters (33)
- 0:00Intro
- 4:08CONTINUOUS DELIVERY CONTINUOUS DEPLOYMENT
- 12:32The IDE Leaks!
- 13:26The BAD ROLE Granularity!
- 14:45The DEV Machine as only source code se
- 17:08All Libraries Allowed!
- 17:56SECRETS & LEAKS
- 19:07Control Artefacts Repository
- 20:02The ENVIRONMENT Leak! (1/2)
- 20:48The ENV Leak! (2/2)
- 21:34A reverse Shell in the Pipeline
- 23:42The Evil GitHub Actions!
- 25:00The mighty CI BOT
- 26:05The EVIL AGENT (1/3)
- 27:54The EVIL AGENT (3/3)
- 28:11The DOCKER HUB Leak!
- 29:19Keep API Safe!
- 30:03The SOURCE CODE ransomware!
- 30:58The Fat DOCKER!
- 31:33The evil DOCKER twin!
- 32:17The Greedy Service consumer!
- 33:13Run FREE Internet!
- 33:41The Trojan Jar!
- 34:22The ZIP BOMB (2/4)
- 38:22The ZIP BOMB (4/4)
- 38:39Memory BOMB (3/5)
- 41:26Memory BOMB (5/5)
- 42:19Fork BOMB! (1/2)
- 44:20Is your API Honest!? (1/2)
- 46:44Keep SECRETS safe!
- 48:15The Evil Alias!
- 49:39The Shared infra! (1/2)
- 50:17The TIP Of the iceberg
related talks
29mAbusing CI/CD - Top Ways to Reach Production
37mSecuring Containers by Breaking In
42mProtecting CI/CD from malicious deploys
26mYour code might be secure, but what about your pipeline? ...
01h 00mContinuous Intrusion: Why CI Tools Are An Attacker's Best Friends
39mContinuous Security at the Next Level
28mPwning the CI (with GitHub Action Workflows)
34mSecure Your Coding Agent Like It’s Malware