[CircleCI Security Alert] Rotate any secrets stored in CircleCI

Announcements Security
42

First off. I appreciate all the efforts CircleCI’s full team is taking to keep us as up to date as possible. I empathize with all of you during these times.

Question:

Can we expect guidance on IOC’s / things to monitor related to the events that led to the recommendation for customers to rotate their keys?

I am looking to empower our SOC w/ as much information as possible. Appreciate a prompt response.

2 Likes
43

Yes, please rotate deploy and user keys.

44

Deploy keys should also be rotated. This support doc should help with understanding what has been impacted: https://support.circleci.com/hc/en-us/articles/11816211460891

45

We will be sending updates as we’re able via email and our blog.

46

So deploy keys were possibly compromised? So we would have to assume that our repositories could have been accessed?

47

Yes, please also rotate deploy keys. Here is a support article listing what was affected and how to rotate them: https://support.circleci.com/hc/en-us/articles/11816211460891

48

Does this incident impact self-hosted CircleCI environments in addition to the SaaS version?

1 Like
49

https://support.circleci.com/hc/en-us/articles/11816211460891 is saying we should rotate CircleCI user access tokens

50

Is there a way to audit which users have access tokens that should be rotated?

51

Yes, all secrets should be rotated. For more information, you can view the Support Article posted

52

We recommend viewing the security audit logs of your VCS for any unauthorized access.

53

That is correct

54

Same question

55

Yes, this would apply as well.

56

You can read more about how we encrypt secrets and sensitive data in our security policy. We cannot share details about what was leaked and any remediation actions at this time outside of what has already been publicly disclosed. We are committed to sharing more details with customers in the coming days."

57

For those asking about CircleCI server customers (full self-hosted installation), this alert does not apply. @SlowIsSmoothIsFast @H4ZM47

1 Like
58

Thank you!

59

We advise that you check the logs of any systems which had secrets stored in CircleCI.

60

Hi jerdog. With this failure of CircleCI, the organization I work for has more than 270 projects, and each one with its own secrets -aws, ssh, deployment, auth tokens… Can you give me some idea of what we can do? Is there any solution other than going from one to one changing all these secrets?
Is there any chance that this breach occur again or are we safe to rotate everything?

61

For CircleCI server customers (full self-hosted installation), this alert does not apply