What If a DevOps Engineer’s Laptop Gets Compromised?

Yes, it has happened. Recently, a company reportedly suffered a major security incident after a DevOps engineer's laptop was compromised. This gave the attacker a route into critical production systems.

A DevOps engineer may have access to critical systems such as AWS, Kubernetes clusters, CI/CD pipelines, repositories, databases and secrets. So, if an attacker compromises a DevOps engineer's laptop, they may be able to misuse the access available to that engineer.

In this incident, the attacker reportedly compromised a DevOps engineer's laptop, gained access to critical company systems and stole up to $6 billion.

So, let's see what happened.

What happened?

1. An attacker's access to an engineer's laptop: An attacker may have gained control of an engineer's laptop. The company has not yet explained exactly how this happened.
2. Access to an internal service container: The attacker allegedly used that access to reach a container running an internal service.
3. Unauthorized withdrawal transactions: The attacker used the service access to submit withdrawal transactions that the company had not authorized.
4. Cryptocurrency moved out: The attacker gained unauthorized access to cryptocurrency funds and transferred them to wallet addresses controlled by the attacker.

A cryptocurrency wallet is a tool that allows someone to store, receive and send cryptocurrency.

Instead of sending cryptocurrency to a legitimate recipient, the attacker transfers it to a wallet they control.

What did the company do when this happened? How did it try to fix the issue?

• Isolated the affected systems to stop further access.
• Removed permissions that could be abused.
• Temporarily stopped customer withdrawals while security checks were performed.
• Reviewed the affected infrastructure and added security controls.
• Worked with blockchain companies, law enforcement and token issuers.
• Committed company funds and its SAFU fund to cover the stolen assets.

However, deposits and other unaffected platform services remained operational, according to the company update.

What security measures should we take to avoid these types of attacks?

Imagine you work in a company that runs applications on AWS and Kubernetes. You have access to the AWS Console and CLI, Kubernetes clusters, Jenkins deployment pipelines, repositories, secrets and application configurations.

If an attacker compromises your laptop, they may be able to misuse the access available to you.

So, what security measures should we take?

• Verify identity and device health before allowing access to critical systems.
• Don't give every engineer administrator access to AWS or Kubernetes.
• Use IAM roles and temporary credentials instead of permanent access keys.
• Use EDR, disk encryption, patching and device monitoring to protect engineer laptops.
• Use AWS Secrets Manager or Vault instead of storing credentials in files.
• Alert on unusual AWS API calls, Kubernetes access and withdrawal activity.
• Ensure that one person cannot independently authorize a sensitive transaction. Two or more authorized people must approve it before the transaction can happen.
• A developer's laptop should not have unrestricted access to critical wallet infrastructure.
• Applications should receive narrowly scoped identities instead of sharing long-lived credentials.
• Flag unusual withdrawal amounts, destinations and transaction patterns.
• Keep wallet-signing operations separate from ordinary application and DevOps environments.

Protecting production infrastructure is not enough if the devices used to access that infrastructure are not protected.