More details have emerged on the recent Codecov system breach which is now being likened to the SolarWinds hack.
In new reporting by Reuters, investigators have stated that hundreds of customer networks have been breached in the incident, expanding the scope of this system breach beyond just Codecov’s systems.
As reported by BleepingComputer last week, Codecov had suffered a supply-chain attack that went undetected for over 2-months.
In this attack, threat actors had gained Codecov’s credentials from their flawed Docker image that the actors then used to alter Codecov’s Bash Uploader script, used by the company’s clients.
By replacing Codecov’s IP address with their own in the Bash Uploader script, the attackers paved a way to silently collect Codecov customers’ credentials—tokens, API keys, and anything stored as environment variables in the customers’ continuous integration (CI) environments.
Codecov is an online software testing platform that can be integrated with your GitHub projects, to generate code coverage reports and statistics, which is why it is favored by over 29,000 enterprises building software.
Hundreds of customer networks breached in Codecov incident
Codecov’s initial investigation revealed that from January 31, 2021, periodic unauthorized alterations of Bash Uploader script occurred which enabled the threat actors to potentially exfiltrate information of Codecov users stored in their CI environments.
But, it was not until April 1st that the company became aware of this malicious activity when a customer noticed a discrepancy between the hash (shashum) of the Bash Uploader script hosted on Codecov’s domain and the (correct) hash listed on the company’s GitHub.
Soon enough, the incident got the attention of U.S. federal investigators since the breach has been compared to the recent SolarWinds attacks that the U.S. government has attributed to the Russian Foreign Intelligence Service (SVR).
Codecov has over 29,000 customers, including prominent names like GoDaddy, Atlassian, The Washington Post, Procter & Gamble (P & G), making this a noteworthy supply-chain incident.
According to federal investigators, Codecov attackers deployed automation to use the collected customer credentials to tap into hundreds of client networks, thereby expanding the scope of this system breach beyond just Codecov’s systems.
“The hackers put extra effort into using Codecov to get inside other makers of software development programs, as well as companies that themselves provide many customers with technology services, including IBM,” a federal investigator anonymously told Reuters.
By abusing the customer credentials collected via the Bash Uploader script, hackers could potentially gain credentials for thousands of other restricted systems, according to the investigator.
U.S. government and Codecov clients investigating the impact
The list of companies and GitHub projects using Codecov is extensive, as seen by BleepingComputer.
A simple search for the link to Codecov’s compromised Bash Uploader script revealed thousands of projects that were or are using the script.
Note, this does not necessarily mean each of these projects was compromised, but rather that the complete impact of this incident is unclear and yet to be known in the upcoming days.
U.S. federal government investigators have therefore stepped in and are thoroughly investigating the incident.
Source: grep.app
Codecov clients including IBM have said that their code has not been modified, but declined to comment on whether their systems had been breached.
However, an Atlassian spokesperson got back to BleepingComputer stating, so far there was no indication of system compromise:
“We are aware of the claims and we are investigating them.”
“At this moment, we have not found any evidence that we have been impacted nor have identified signs of a compromise,” Atlassian told BleepingComputer.
Hewlett Packard Enterprise (HPE), which is another one of Codecov’s 29,000 customers, said they were continuing their investigation into the incident:
“HPE has a dedicated team of professionals investigating this matter, and customers should rest assured we will keep them informed of any impacts and necessary remedies as soon as we know more,” an HPE spokesman Adam Bauer told Reuters.
The Federal Bureau of Investigation (FBI) and the U.S. Department of Homeland Security (DHS) have not commented on the investigation at this time.
Codecov customers who, at any point in time used Codecov’s uploaders (the Codecov-actions uploader for Github, the Codecov CircleCl Orb, or the Codecov Bitrise Step), are advised to reset credentials and keys that may have been exposed as a result of this attack, and to audit their systems for any signs of malicious activity.