Code Repositories (MITRE ATT&CK T1213.003) is a sub-technique of data from information repositories. The adversary collects valuable information from code repositories. MITRE files it under Collection and lists SaaS as the platform.
For many companies, source control is the most sensitive system after the identity provider.
How attackers use it
MITRE explains that code repositories store source code and automate software builds. They may be hosted internally, or on third-party sites such as GitHub, GitLab, SourceForge and Bitbucket. Users interact with them through a web app or command-line tools such as git.
Once an adversary gets into a victim network or a private repository, they may collect proprietary source code, or credentials stored in the code. Source code can help them develop exploits. Credentials can give access to more resources through valid accounts.
MITRE notes that this technique is separate from the reconnaissance technique that uses public code repositories.
The MITRE page lists cases of attackers cloning victims' Git repositories during intrusions, searching a victim's network for GitLab and GitHub to find more high-privilege credentials, and malware that collected npm and GitHub authentication material, including npm configuration data for the auth token.
How to detect it
MITRE's detection strategy for SaaS platforms is about bulk or anomalous access to private repositories:
- Anomalous or bulk download or clone activity from private or restricted repositories
- Access by non-developer or privileged accounts
- Unusual logins beforehand, such as an unfamiliar geography, OAuth token use or an elevated API rate
Practical steps: turn on audit logs for your source control platform and stream them to a place you query. Build alerts for a user cloning many repositories in a short time, for a token used from a new network, for access to repositories that the account has never touched, and for new personal access tokens or OAuth app grants. Review who has organization-wide read access.
Remember that repositories also leak by accident. Credentials committed years ago still sit in history.
How to reduce the risk
MITRE's mitigations:
- Audit. Review accounts and privileges for critical and sensitive repositories on a regular schedule. Scan repositories for exposed credentials and other sensitive data.
- Use multi-factor authentication for logons to code repositories.
- Apply least privilege, with access control that includes authentication and authorization for repositories.
- Publish a policy on what may be stored in code repositories.
Check your own environment
- Who can read every repository in your organization, and does each person need to?
- Is MFA enforced for all accounts, including service and bot accounts?
- How many personal access tokens and OAuth apps exist, and when were they last reviewed?
- Do your repositories, including history, contain keys, passwords or tokens?
- Do you get an alert when someone clones dozens of repositories at once?
- Do CI systems hold long-lived credentials with wide repository access?
Try it yourself
The audit step in MITRE's mitigation list includes scanning for exposed credentials. This demo shows what secrets scanning finds and how to read the results.
Click through it at your own pace, or open it full screen.
Quick check
Why are credentials in source code a double problem?
They can give the attacker access to more resources through valid accounts, and the source code itself can help them build exploits.
Which accounts does MITRE's detection strategy suggest watching?
Non-developer and privileged accounts that download in bulk from private repositories, especially after unusual logins such as an unfamiliar geography or OAuth token use.
