Rapid7 says its source code was accessed after CodeCov hack
Cyber criminals gained access to code used for internal tooling and its flagship detection and response service
Cyber security firm Rapid7 has revealed that a cyber attack against its supplier CodeCov led to hackers accessing a subset of its source code repositories.
The code coverage platform CodeCov suffered an incident last month in which attackers broke through its defences and modified its Bash Uploader script, meaning hundreds of clients who executed the script may have also been compromised.
Rapid7, which uses the service, confirmed it was among the string of companies whose networks were infiltrated due to the attack. The cyber criminals accessed source code used for the firm’s internal tooling as well as its managed detection and response (MDR) service.
MDR is a set of capabilities that Rapid7 markets as being able to detect advanced threats and stop attackers while infiltration attempts are in process. Part of the package includes threat hunting, 24/7 monitoring, as well as rapid incident response.
The source code repositories accessed also contained internal company credentials, which have all been rotated, and alert-related data for a portion of MDR customers. Rapid7 has said it has contacted any customers that may be affected.
Codecov develops auditing tools that clients can use to see how thoroughly their own code is being tested, which may give this tool access to credentials for internal software accounts.
Cost of a data breach report 2020
Find out what factors help mitigate breach costsDownload now
Following the breach, the FBI feared that the attackers used an automated system to copy those credentials and raid additional resources, according to Reuters.
IBM was also among the companies to have revealed they were using Codecov, although a spokesperson told the publication at the time that they had found no modifications of code involving IBM or its clients.
The hack, described as a supply chain attack, is eerily similar in nature to both the SolarWinds Orion attack in late 2020 and the Microsoft Exchange Server breach earlier this year. These are considered among the worst security incidents in recent months, and both saw potentially thousands of businesses compromised after the systems of their supplier, in each case, was breached.
How to choose an AI vendor
Five key things to look for in an AI vendorDownload now
The UK 2020 Databerg report
Cloud adoption trends in the UK and recommendations for cloud migrationDownload now
2021 state of email security report: Ransomware on the rise
Securing the enterprise in the COVID worldDownload now
The impact of AWS in the UK
How AWS is powering Britain's fastest-growing companiesDownload now