US investigators probing a breach at Codecov, a software auditing company, that affected some of its 29K customers; the breach was in Jan. but detected in April
Related Coverage
- Bash Uploader Security Update Codecov
- Federal investigators looking into breach at software code testing company Codecov The Verge
- US authorities investigate hack of software auditing company Codecov SiliconANGLE
- US investigates code testing hack that could affect thousands of companies Engadget
- Backdoored developer tool that stole credentials escaped notice for 3 months Ars Technica
- Popular Codecov code coverage tool hacked to steal dev credentials BleepingComputer
- U.S. Federal Investigators Are Reportedly Looking Into Codecov Security Breach, Undetected for Months Gizmodo
- Will the CodeCov breach become the next big software supply chain hack? SC Media
- Codecov dev tool hit in another supply chain hack CyberScoop
Discussion
-
@ph1
Pete Hodgson
on x
Oh wow, this is a brutal vulnerability. Anyone using a certain method to upload code coverage numbers was also possibly sending any secrets in their CI env vars (quite likely direct access to prod) directly to hackers. https://about.codecov.io/...
-
@lizrice
Liz Rice
on x
“it would have been easy for Codecov or any of its customers to detect the malice by [simply] checking the shasum. The ability for the malicious version to escape notice for three months indicates that no one bothered to perform this simple check” 😰 https://arstechnica.com/...
-
@flugazi
@flugazi
on x
Codecov breach impacts GoDaddy, Atlassian, P&G etc. https://www.reuters.com/...
-
@ihadrami_
@ihadrami_
on x
@Techmeme Gosh! It took them around three months to detect the breach, and I wonder if any of their clients was impacted seriously when the software was in circulation.