step-security / github-actions-goat Goto Github PK

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#exfiltrating-data-from-a-runner

Issue created using GitHub Actions workflow

• simulate exfiltration of token instead of repo (idea)
• add block mode in harden-runner
• add missing domain - storage.googleapis.com

Issue created using GitHub Actions workflow

@arjundashrath this issue is to track the improvements you are planning to make.

You can track tasks here if you want:

• task1
• task2
• ...

Organize the project into two parts

1. Simulation of past attacks

• SolarWinds (SUNPOST) - already exists
• Codecov (tampering of artifact in storage account) - to be added
• Dependency confusion - to be added
• Malicious npm package to exfiltrate data on install step (simulation of malicious packages published after account take over/ typosquatting) - already exists
• Pipeline injection in GitHub Actions (simulation of VS Code bug bounty issue) - to be added

2. Solutions

Issue created using GitHub Actions workflow

Basic CI/CD pipelines and GitHub actions knowledge required

Issue created using GitHub Actions workflow

Use ci.yml instead

Issue created using GitHub Actions workflow

Issue created using GitHub Actions workflow

Issue created using GitHub Actions workflow

• mention average time per tutorial in the readme

https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md

e.g. codecov breach

• add link to discussion in the tutorial

Issue created using GitHub Actions workflow

• Setup a node project
• Add table of past npm packages that were compromised and made outbound calls
• Setup a node dependency that does outbound call on post-install step
• Use harden-runner to show outbound traffic
• Add reference to the tutorial on restricting traffic from build server

e.g. outbound traffic during test run

https://medium.com/@etienne.dusseault?p=e12da346aa53

I just tried the following tutorial: https://github.com/step-security/attack-simulator/blob/1948a848cc4bdfb224343b29b9ca010da3488c12/docs/DNSExfiltration.md

Here is the fork I created: https://github.com/DataDog/step-security-agent-attack-simulator

At the end I do get the same result as the screenshot in the tutorial, that is, the "build" job is successful but has an "Error: DNS resolution [...] was blocked" annotation.

However, I am quite surprised that the build job is successful if the hardened runner blocked the DNS resolution, right?

Moreover, if I click on the "build" job and expand the "Simulate DNS traffic" section, it looks like the DNS call was successful, meaning that the DNS exfiltration attack would have worked right?

Run domain="${GITHUB_REPOSITORY}.stepsecurity.io"
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	DataDog-step-security-agent-attack-simulator.stepsecurity.io
Address: 54.185.253.63

Isn't this "a valid response from the DNS server"?

@arjundashrath can we add the nodetest npm package to this repo, in a separate folder?