Rapid7 says its source code was accessed after CodeCov hack

Cyber criminals gained access to code used for internal tooling and its flagship detection and response service

Cyber security firm Rapid7 has revealed that a cyber attack against its supplier CodeCov led to hackers accessing a subset of its source code repositories.

The code coverage platform CodeCov suffered an incident last month in which attackers broke through its defences and modified its Bash Uploader script, meaning hundreds of clients who executed the script may have also been compromised.

Rapid7, which uses the service, confirmed it was among the string of companies whose networks were infiltrated due to the attack. The cyber criminals accessed source code used for the firm’s internal tooling as well as its managed detection and response (MDR) service.

MDR is a set of capabilities that Rapid7 markets as being able to detect advanced threats and stop attackers while infiltration attempts are in process. Part of the package includes threat hunting, 24/7 monitoring, as well as rapid incident response.

The source code repositories accessed also contained internal company credentials, which have all been rotated, and alert-related data for a portion of MDR customers. Rapid7 has said it has contacted any customers that may be affected.

Codecov develops auditing tools that clients can use to see how thoroughly their own code is being tested, which may give this tool access to credentials for internal software accounts.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

Following the breach, the FBI feared that the attackers used an automated system to copy those credentials and raid additional resources, according to Reuters.

IBM was also among the companies to have revealed they were using Codecov, although a spokesperson told the publication at the time that they had found no modifications of code involving IBM or its clients.

The hack, described as a supply chain attack, is eerily similar in nature to both the SolarWinds Orion attack in late 2020 and the Microsoft Exchange Server breach earlier this year. These are considered among the worst security incidents in recent months, and both saw potentially thousands of businesses compromised after the systems of their supplier, in each case, was breached.

Featured Resources

How to choose an AI vendor

Five key things to look for in an AI vendor

Download now

The UK 2020 Databerg report

Cloud adoption trends in the UK and recommendations for cloud migration

Download now

2021 state of email security report: Ransomware on the rise

Securing the enterprise in the COVID world

Download now

The impact of AWS in the UK

How AWS is powering Britain's fastest-growing companies

Download now

Recommended

ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021
Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
CISOs aren’t leading by example when it comes to cyber security
cyber security

CISOs aren’t leading by example when it comes to cyber security

24 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021
Fastly blames software bug for major outage
public cloud

Fastly blames software bug for major outage

9 Jun 2021
GitHub to prohibit code that’s used in active attacks
cyber security

GitHub to prohibit code that’s used in active attacks

7 Jun 2021