Rial_Labs

5 ms·

1.
by Rial_Labs 5mo ago
The Trivy attack did not hack anyone's secrets manager. It just waited until the key was retrieved and sitting in memory as a plaintext string. Then read it. VaultProof solves that specific moment. The key never exists as plaintext
2.
by Rial_Labs 5mo ago
The Trivy malware bypassed log masking entirely by reading directly from runner process memory. Secrets managers did not help because the credentials had already been retrieved and placed in memory as plaintext strings. That is what got
3.
Cisco got hacked through a security scanner(vaultproof.dev)
2 points by Rial_Labs 5mo ago|3 comments
4.
by Rial_Labs 5mo ago
Exactly. It is a UX problem as much as a security problem.
5.
by Rial_Labs 5mo ago
Ephemeral tokens are a valid approach and some systems use exactly that. The difference with Shamir is what happens if the proxy itself is compromised. With token exchange the proxy holds or can reconstruct the real key server side. A com
6.
by Rial_Labs 5mo ago
Correct. As an attacker you just move one level deeper. If the target pins their direct actions to commit hashes you compromise a dependency of the action instead. They pinned the top of the tree but you own something in the middle of it.
7.
by Rial_Labs 5mo ago
You're right and forking actions is the correct mitigation. The gap is operational discipline. Most teams know they should fork upstream actions and review updates before pulling them in. Almost none actually do it consistently. The
8.
by Rial_Labs 5mo ago
Fair criticism on the framing and it reads more promotional than I intended. Took a look at OneCLI after your comment. The approaches are different. OneCLI stores the real key encrypted and decrypts it at request time, injecting it as a he
9.
by Rial_Labs 5mo ago
OIDC is the right call for cloud provider credentials like AWS, GCP, Azure all support it well and short lived tokens are genuinely better than static keys. The gap is third party APIs. OpenAI, Stripe, Anthropic, GitHub. None of them sup
10.
by Rial_Labs 5mo ago
Two things combined. First: Git tags are not immutable. When you write actions/trivy-action@v0.69.4 in your pipeline you are not pinning to a fixed commit. The tag is just a pointer and whoever controls the repo can silently move it
11.
by Rial_Labs 5mo ago
The auto routing tier selection is interesting, curious how it handles the credential surface area as you add providers. Each provider in the rotation is another API key that needs to exist somewhere in the request path. With 7+ providers,
12.
by Rial_Labs 5mo ago
Author here. Built VaultProof after analyzing the Trivy attack the credential harvesting worked specifically because the keys existed as plaintext in the CI/CD environment after retrieval from the secrets manager. Happy to go deep on
13.
How the Trivy supply chain attack harvested credentials from secrets managers(vaultproof.dev)
18 points by Rial_Labs 5mo ago|16 comments