Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
CircleCI said an attacker used malware on an employee’s laptop to steal an authenticated SSO session, then accessed and exfiltrated data from a subset of its databases and stores. The company’s January 12, 2023 report says the stolen data included customer environment variables, tokens, and keys. It did not state how many customers or records were affected.
How the CircleCI attack happened
The incident details below are CircleCI’s reported findings. The report describes this sequence:
- Endpoint compromise: CircleCI said an engineer’s laptop was compromised on December 16, 2022. Its antivirus software did not detect the malware.
- Session theft: The malware stole a valid SSO session protected by two-factor authentication. The attacker used the stolen session cookie to impersonate the employee remotely.
- Access escalation: The attacker escalated access to a subset of production systems. The employee’s normal duties included privileges to generate production access tokens.
- Data access and exfiltration: CircleCI said the attacker accessed and exfiltrated data from a subset of databases and stores, including customer environment variables, tokens, and keys. The company reported that the attacker extracted encryption keys from a running process, potentially enabling access to data that was encrypted at rest. CircleCI’s incident report provides its account of the attack.
Why MFA and encryption at rest did not prevent exposure
A stolen session can bypass a fresh MFA challenge
Two-factor authentication helps prevent an attacker from signing in with only a password. In CircleCI’s reported scenario, however, the malware stole a session that had already been authenticated. The attacker could then use that session cookie to impersonate the employee. This is a specific reported attack path, not evidence that MFA is generally ineffective.
Encryption at rest depends on protecting the keys
Encryption at rest protects stored data when the encryption keys remain unavailable to an attacker. CircleCI said the attacker extracted keys from a running process; that could enable access to the encrypted data. Encryption therefore did not, by itself, rule out exposure in this incident.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Sale
Peslv Magnetic Privacy Screen for Surface Laptop 6/5/4/3/2/1-13.5 Inch
- 【WIDELY APPLICABLE】Peslv Surface laptop magnetic privacy filter designed for Surface laptop, Compatible with 13.5" Microsoft Surface Laptop 6/5/4/3/2/1 (released in 2024-2017). Removable design and comes with a Surface laptop privacy screen protector storage clip that can be taken and used as needed, perfect for various occasions where screen privacy needs to be protected.Like offices, airports, cafes, trains, etc.
- 【NEW 3RD GENERATION】 We have innovated the installation method of the surface laptop privacy film, using the bottom magnetic suction and the top nano suction installation method, the installation will become super easy, It's done in a second... The removable, washable design will allow the surface laptop 13.5 inch privacy screen to be reused and look new every day.
- 【STUNNING PRIVACY PROTECTION】To ensure that only the +-28° angle directly in front of the screen is visible, we have corrected the angle of the SurfaceLaptop 4 privacy screen more than 5000 times to ensure that other angles of view are not visible. By getting the Peslv magnetic privacy screen Surface Laptop 13.5 inches, you can ensure that your computer data privacy is not peeked.
- 【PROTECT SCREEN ALSO EYES】The high-quality materials imported from Japan and the process imported from Germany have greatly improved the performance of the magnetic privacy screen Surface Laptop 3 High-quality filter layer that can reduce 95% of blue light and 92% of UV light. Matte surface, anti-glare, effectively intercepts 95% of the reflected light. Anti-scratch layer to avoid scratches from daily use. Protect your screen while protecting your eyesight.
- 【HIGH-GRADE MATERIALS AND CRAFTSMANSHIP】Modeled in accordance with the real screen size 1:1 restoration, the size is perfectly matched. The light-transmitting layer with advanced material has a super high light transmission rate. So all this will make you have a super high-definition Surface Laptop 2 privacy screen with unparalleled picture quality close to the original picture.
CircleCI’s reported incident timeline
| Date and time | Reported event |
|---|---|
| December 16, 2022 | CircleCI said the engineer’s laptop was compromised. |
| December 19, 2022 | CircleCI said reconnaissance activity occurred. |
| December 22, 2022 | CircleCI said data exfiltration occurred; this was its last recorded unauthorized activity in production. |
| January 4, 2023 | CircleCI disclosed the incident and advised customers to rotate secrets stored in CircleCI and review logs in systems that held those secrets. |
| January 4, 16:35 UTC | CircleCI shut down access for the employee account. |
| January 4, 18:30 UTC | CircleCI restricted production access to a very small operational group. |
| January 4, 22:30 UTC | CircleCI reported rotating potentially exposed production hosts. |
| January 5, 03:26 UTC | CircleCI revoked Project API Tokens. |
| January 6, 2023 | CircleCI revoked older Personal API Tokens and worked with Atlassian to rotate Bitbucket tokens. |
| January 7, 2023 | CircleCI completed rotation of GitHub OAuth tokens. |
| January 12, 2023 | CircleCI said AWS had completed notifications to customers about potentially impacted AWS tokens. CTO Rob Zuber published the incident report. |
The dates and response actions are from CircleCI’s incident report and security alert.
What CircleCI customers should do after a secrets exposure
- Identify affected credentials: List secrets stored in CircleCI that could have been exposed, including what service issued each credential and what systems it could access.
- Rotate at the source: Revoke or replace each credential in the service that issued it. CircleCI’s alert stressed that removing a value only from CircleCI is not enough; the original credential must be changed at the source system.
- Update CircleCI: Store the replacement secret in CircleCI after rotating it at the issuing service.
- Review downstream logs: Check logs in the systems those credentials could reach for suspicious activity. CircleCI specifically recommended reviewing logs in systems that held the secrets.
- Use audit logs where available: CircleCI said it made self-serve audit logs available to all customers, with up to 30 days of queryable data and 30 days to download results, according to its alert.
CircleCI’s security alert also addressed customer questions such as “Can I build?” and “How can I access my audit logs for CircleCI?”
Rank #2
Sale
CloudValley Laptop Camera Cover Slide, Metal 0.023 Inch Ultra-Thin, 2 Packs
- Privacy Protection: CloudValley webcam cover is designed for those who prioritize privacy, security, and peace of mind when using laptops, tablets, and computers
- Fashion Design: The space aluminum alloy webcam cover features a subtle design which compliments the beautiful aesthetic of top devices
- Ultra-Thin Design: Measures only 0.023 (0.6 mm) inch thin, ensuring it does not interfere with closing your laptop or device while providing reliable camera coverage
- Broad Compatibility: Works flawlessly with most laptops (MacBook, HP, Dell, Asus, Acer, Lenovo), All-in-One PCs and leading tablets including iPad, Surface Pro, Galaxy Tab, Fire HD, and Google Pixel Tablet
- Simple to Use: Only need to align to the webcam, attach and press it firmly for 15 seconds. Does not interfere with web use or indicator light
Security lessons from the incident
The incident illustrates why security depends on several controls working together, rather than on a single safeguard. CircleCI CTO Rob Zuber wrote, “While one employee’s laptop was exploited through this sophisticated attack, a security incident is a systems failure.” CircleCI’s report does not claim that any particular product would have prevented the attack.
- Protect endpoints and detect suspicious activity: Malware went undetected by the antivirus software CircleCI said was on the laptop. Endpoint protection and monitoring of unusual session behavior address different parts of the problem.
- Limit production privileges: Reduce standing employee access and the ability to generate production tokens to what a role needs. Smaller privileges can limit the access available after an account is compromised.
- Control session lifetime and revocation: Session controls matter after login as well as during it. Shorter-lived sessions and a rapid way to revoke them can reduce the usefulness of a stolen cookie.
- Segment systems and secrets: Keep credentials and production systems separated so compromise of one account or store does not automatically open access to everything.
- Make credential rotation operationally ready: Maintain an inventory of secrets, their owners, and the systems they reach so credentials can be revoked and replaced quickly, then validate the replacement in the relevant services.
What the public report does not establish
CircleCI described access and exfiltration involving a subset of databases and stores, but the report does not quantify affected customers, records, or total data volume. The published account therefore does not support saying that every CircleCI customer was affected or assigning a total impact figure.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Quick Recap
Best Value
Sale
Yilador Webcam Cover 3 Pack, 0.03 inch Ultra Thin Laptop Camera Cover Slide
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
Rank #4
Sale
Laptop Camera Cover Slide, 6 Pack Ultra-Thin 0.022in Webcam Cover Blocker
- 【Protect Privacy Security】Focusing on network security, now we can easily and effectively protect personal and family privacy security , Just gently slide the slide and close the camera, you can stop the intrusion of hackers.
- 【 Ultra Thin Design】The new ultra-thin design, with a thickness of only 0.022 inches, is made of flexible ABS material and is not fragile. Will not affect the closing of the laptops and scratch the laptops.
- 【Easy to install】 Strong adhesive makes the cover not fall, keep the screen clean and free of stains during installation, tear off the adhesive tape on the back, align it with our camera, and press hard for 10 seconds to work.
- 【Compatible with 】Compatible with camera for Laptop, tablet, computers, Echo Show and Apple Devices,as: MacBook Pro,Macbook Air,iMac ,Mac mini,iPad,MacBook Air, iPhone 6/7/8 Plus etc front camera .
- [What you get] 6 pack black webcam covers.
Rank #3
JOS California 9 Pack(3 Large + 3 Medium + 3 Small) 0.03 inch Ultra Thin Webcam Cover Slide Camera Blocker Protect Your Privacy Security for MacBook Air, Laptop, iPad, iMac, PC, iPhone
- ✅Package included: California JOS (3Large+3Medium+3Small) webcam Privacy cover in Black color, All In One Solution in one Package, Assembly &Packed in USA !
- ✅ Ultra-thin design by California JOS: Super thin design, perfect curve edges, and extra mini size, which means it can be perfectly combine with your devices. Webcam Cover is only 0.03 inches thick and does not feel its existence when the laptop lid is closed.
- ✅ Universal Design by California JOS: Webcam Cover is compatible with most Laptop Computer, Smartphones, iPad,iphone, MacBook, MacBook Pro, Tablets PC, PS4 and all-in-one desktops. Many pieces package, meet your all cameras need.
- ✅ Easy to Install: Use cloth to clean the surface of device's webcam, then remove adhesive tape from the back of the camera cover Slide, align the lens, and firmly press for 15 seconds to achieve a strong, Also, the adhesive can be easily applied and removed from the device without any traces.
- ✅ Variety of sizes/shapes: Includes 9 pieces (3 large ovals, 3 medium rectangles, 3 standard ovals) in black color. A versatile solution for all your devices—laptops, tablets, phones, webcams, and more! With at least 3 options, it suits any situation. The large oval is specifically designed for the Tesla Model 3/Y interior cabin camera.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
