Software supply chain breach akin to SolarWinds incident, allegedly compromised by Codecov hack

In a series of unfortunate events, Codecov, a popular code testing service, has been the victim of a malicious supply chain attack. The breach, which was confirmed on April 30, 2021, has sparked concerns within the DevOps community and is currently under investigation by federal authorities, including the U.S. Department of Homeland Security (DHS) and the FBI.

The breach affected Codecov's Bash Uploader script 108 times between January 31 and April 1. Attackers accessed the script and exfiltrated customer information stored in Codecov's continuous integration (CI) environments. In response, Codecov hired an outside forensics company to investigate the breach and contacted the affected customers, advising them to rotate their credentials and environment variables.

Despite the breach, Checkmarx, a software security company, found no evidence that Codecov or its customers were affected. However, as a precautionary measure, they removed the integration from limited instances where it was used. Other companies, such as CircleCI, have also confirmed that their integration with Codecov was affected. IBM, for instance, stated that they found no modifications of code involving clients or IBM in relation to the Codecov breach.

The potential impact of the breach extends beyond Codecov. Sandy Carielli, a principal analyst at Forrester Research, expressed concern about the potential use of the Codecov breach as a launching pad for attacks against Codecov customers. Ilkka Turunen, Field CTO at Sonatype, further emphasised this concern, stating that the Codecov incident is typical of an increasingly concerning attack form, targeting internal development infrastructure. Sonatype officials consider development infrastructure part of the security frontline.

The Codecov breach could be compared to the nation-state attack against SolarWinds, which also targeted a software supply chain. Officials at the Cybersecurity & Infrastructure Security Agency did not return a request for comment regarding the Codecov breach, while the FBI did not confirm or deny the existence of a current investigation.

As the investigation continues, many Codecov customers are still working to assess the impact of the breach on their systems. It is a reminder for all organisations to prioritise security measures and be vigilant against potential threats to their supply chain.

Software supply chain breach akin to SolarWinds incident, allegedly compromised by Codecov hack