Securing CI/CD Systems Through eBPF - Alex Ilgayev, Cycode

Securing CI/CD Systems Through eBPF - Alex Ilgayev, Cycode

The challenging nature of securing CI/CD pipelines, mainly because of inadequate security tooling and low observability of the underlying system, would make using the eBPF technology inevitable. This technical talk aims to demonstrate how eBPF can be used to secure CI/CD pipelines, whether they run on bare-metal, virtual machines, or ephemeral environments. By combining dedicated research, an innovative approach, and proper tooling, we can inject an eBPF-based implant into every build environment quickly and easily, to inspect, identify, and protect against malicious activity. We will demonstrate the following use-cases: - Visibility over the entire build process - created processes, contacted IP addresses/domains, modified files, traffic inspection, etc. - Ensure code and artifact integrity. - Denying build process tampering. - Maintain a tight network policy to prevent processes from exfiltrating sensitive secrets, such as tokens and environment variables. We will demonstrate how we can stop the deadliest software supply chain attacks while supporting all major CI/CD platforms, such as Github Actions, Jenkins, GitlabCI, and CircleCI.

[otmanekalli]

Love the ebpf technology, please keep sharing such content

[rkupson]

About the case I (SolarWinds) - if I remember correctly that was quite targeted and advanced attack (APT like) so if the malicious code couldn't write to the filesystem it could as well ptrace(2) the compiler and fed it fake file or take other approach from probably hundreds possible. The attackers I think just chose simplest working solution.