Software auditing company Codecov, which has 29,000 customers, is under investigation for an intrusion into its database. The intrusion has knock-on effects, the company says, and federal investigators are investigating. The intrusion was found by a savvy user who was using the company’s code-checking software.
Hacking intrusion affects 29,000 customers
A hacking intrusion in Codecov has affected 29,000 customers. The hackers have gained access to secret credentials used during the build process. They then used the stolen credentials to make tweaks to one of Codecov’s tools. Now, those tools can steal other people’s secrets.
The hacking intrusion affects companies in the tech industry, from big companies to small ones. Many of these companies use open source tools. Codecov, which is used by millions of software developers, has confirmed the breach, but declined to reveal the exact number. The company said it has opened an investigation, but declined to disclose further details. Federal officials and the Department of Homeland Security have not responded to requests for comment.
Codecov has since fixed the vulnerability and notified customers. Users should roll over their passwords and change their passwords. The company is also rotating internal credentials and has hired a third-party cyberforensics firm to carry out an audit. In addition, the company has installed new monitoring systems.
Codecov is working with law enforcement to investigate the intrusion. According to their security advisory, the attackers altered a script called Bash Uploader that allows them to compromise the accounts of over 29,000 Codecov customers. The attackers have contacted victims via emails and a banner in their Codecov applications.
The attackers gained access to the software through an error in the Docker image created by Codecov. Once inside, the hackers could change the IP address of Codecov and post user information on their servers. The hacking intrusion could have implications for the software supply chain.
As of Monday afternoon, only three companies have publicly admitted to being compromised. In the industry, compromising source code is a risky move that can cause massive reputation damage. Because the damage is so great, some companies choose to remain secretive. Interestingly, HashiCorp was the first major company to publicly disclose a breach. The company also revealed that the security incident exposed customer email addresses.
Impact on big enterprises
Codecov has recently announced that it has discovered a security breach. This breach affected more than 29,000 of its enterprise customers. The breach lasted from January 31 to April 1, Codecov said in a blog post. The company confirmed to Cybersecurity Dive that the breach affected its integration with its code coverage tool, CircleCI.
The Codecov breach has revealed a trend in cybersecurity. As companies become more interdependent and dependent on third-party software and services, the environment has become more volatile and inherently in favor of attackers. Changing this dynamic will require systemic solutions. To do so, the current systemic drivers of cybercrime must be addressed. For example, governments are now investing massive amounts of money in computer hacking. Moreover, as more organisations rely on third-party software, supply chain attacks will be more common.
CodeCov’s customers may not pay attention to the granular details of the code. For instance, they may not have noticed a problem if the signature was different from another machine. This may have led to an attack. Fortunately, CodeCov’s customers have the choice of signing up with an email address or a social signer, which keep contact information private.
The security breach in Codecov could have a large impact on the software supply chain. According to the company, the breach occurred when an unknown third-party changed a Bash Uploader script that allows it to send coverage reports to its customers. This allowed hackers to access customer information. The breach is not just affecting big enterprises, but also the supply chain of software and services.
Codecov has notified the affected parties. As a precaution, it has hired an outside forensics firm to conduct an investigation. It has also cooperated fully with law enforcement authorities and reported the incident to the appropriate authorities. However, it is unclear how many of its customers were affected by the vulnerability.
Although this attack may not have affected specific clients, it is still possible that the hackers may have compromised thousands of other restricted systems. In response to the codecov breach, IBM said it was alerting dozens of likely victims on Monday. Meanwhile, private security companies were assisting multiple clients. Codecov did not respond to Reuters’ requests for comment.
Impact on open source tools
This week’s Breach Report focuses on Codecov, a company that was hacked and compromised. The compromise occurred over a period of 2.5 months, which raises questions about how safe Open Source tools are. Codecov is a well-known open source project that offers free scans. Its software is designed for developers who use open source tools in their work.
The company produces software auditing tools, including Codecov, which is used by over 29,000 enterprise companies. The breach occurred in January 2021 and may have provided attackers access to client networks. The company has posted an advisory answering questions related to the breach. It also recently revealed that its supply chain was compromised, exposing its GPG signing key.
As a result of this breach, Codecov is revolving its internal credentials and pulling in a third-party cyberforensics firm. It is also creating a new monitoring system. The attack may have implications for the FBI, which has launched an investigation into the company.
The attackers gained access to Codecov by exploiting a vulnerability in its Docker image creation process. The exploit allowed an attacker to alter a script and export information. Additionally, the attackers used automated methods to copy credentials from other CI environments and software development programs. They then used the exploit to access other software development programs and technology service companies.
The attack on Codecov has affected over 29,000 enterprise customers. Although the company has contacted the affected companies, it has yet to identify any nation-state or group behind the attack. The company has yet to determine the source of the attack but has said it will investigate the incident and notify affected customers.
A list of customers affected by the attack can be found here. The company’s customers were informed of the breach and instructed to change their credentials and environment variables. IBM is currently investigating this breach. The company also says it is taking additional measures to ensure that customers are protected. If you are using one of these tools in your development pipeline, you should be very careful when using it.
While this breach was small in scale, it did highlight a vulnerability in the system. The attackers had access to the codecov testing script on the test machines used by customers’ continuous integration environments. The malicious software exported sensitive data from these environments and sent it to a remote attacker’s control. This means that any organization using Codecov should immediately update its security systems.
The attackers targeted Codecov because it offers a suite of code testing tools. The goal of the company is to ensure that code is safe and secure before it is deployed into production. Codecov has developed a Bash uploader tool that integrates with popular development environments and generates code coverage reports.
