Monday, January 30, 2023
Home Reviews CircleCI says hackers stole encryption keys and customers’ secrets

CircleCI says hackers stole encryption keys and customers’ secrets

CircleCi, a software company whose products are popular with developers and software engineers, confirmed that some customers’ data was stolen in a data breach last month.

The company said in a detailed blog post on Friday that it identified the intruder’s initial point of access as an employee’s laptop that was compromised with malware, allowing the theft of session tokens used to keep the employee logged in to certain applications, even though their access was protected with two-factor authentication.

The company took the blame for the compromise, calling it a “systems failure,” adding that its antivirus software failed to detect the token-stealing malware on the employee’s laptop.

Session tokens allow a user to stay logged in without having to keep re-entering their password or re-authorizing using two-factor authentication each time. But a stolen session token allows an intruder to gain the same access as the account holder without needing their password or two-factor code. As such, it can be difficult to differentiate between a session token of the account owner, or a hacker who stole the token.

CircleCi said the theft of the session token allowed the cybercriminals to impersonate the employee and gain access to some of the company’s production systems, which store customer data.

“Because the targeted employee had privileges to generate production access tokens as part of the employee’s regular duties, the unauthorized third party was able to access and exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys,” said Rob Zuber, the company’s chief technology officer. Zuber said the intruders had access from December 16 through January 4.

Zuber said that while customer data was encrypted, the cybercriminals also obtained the encryption keys able to decrypt customer data. “We encourage customers who have yet to take action to do so in order to prevent unauthorized access to third-party systems and stores,” Zuber added.

Several customers have already informed CircleCi of unauthorized access to their systems, Zuber said.

The post-mortem comes days after the company warned customers to rotate “any and all secrets” stored in its platform, fearing that hackers had stolen its customers’ code and other sensitive secrets used for access to other applications and services.

Zuber said that CircleCi employees who retain access to production systems “have added additional step-up authentication steps and controls,” which should prevent a repeat-incident, likely by way of using hardware security keys.

The initial point of access — the token-stealing on an employee’s laptop — bears some resemblance to how the password manager giant LastPass was hacked, which also involved an intruder targeting an employee’s device, though it’s not known if the two incidents are linked. LastPass confirmed in December that its customers’ encrypted password vaults were stolen in an earlier breach. LastPass said the intruders had initially compromised an employee’s device and account access, allowing them to break into LastPass’ internal developer environment.

Updated headline to better reflect the customer data that was taken.

- Advertisment -

Most Popular

4 arrested after armed attempt to enter Mississauga, Ont. business, police say

Police have arrested four people, including three teenagers, after they allegedly attempted to enter a business in Mississauga, Ont., with a handgun. The local police...

France’s plan to raise pension age ‘no longer negotiable’, prime minister says

France’s prime minister insisted Sunday that the government’s plan to raise the retirement age from 62 to 64 is “no longer negotiable,” further angering...

Artist dazzles: draws maps of Canadian cities with one continuous line

For Montreal artist, Abou Dembele, art has rules. Dembele is prolific in the world of one-line art. Read more: Video of Toronto Blue Jays star Vladimir...

Alberta landowners fear repeat of orphan well crisis as renewable energy booms

Once bitten, twice shy. It’s an old adage that explains why Jason Schneider, the elected reeve of Vulcan County, Alta., is jittery about the renewable...