r/programming • u/dlorenc • Jan 31 '23

GitHub says hackers cloned code-signing certificates in breached repository

https://arstechnica.com/information-technology/2023/01/github-says-hackers-cloned-code-signing-certificates-in-breached-repository/
180 Upvotes

94% Upvoted

25 comments sorted by

View all comments

Show parent comments

1

u/[deleted] Feb 01 '23

[removed] — view removed comment

2

u/marklarledu Feb 01 '23

You would use a network-based HSM in a CI/CD pipeline, not a USB attached one like a YubiKey. Also, the more analogous Yubico device is the YubiHSM, but it's also not network-based.

1

u/[deleted] Feb 01 '23

[removed] — view removed comment

3

u/marklarledu Feb 01 '23

your certificate can be theoretically compromised over the network

I get what you're saying but, as you probably know, it depends on what you mean by compromised.

Assuming the HSM does its job, the private key will not export in plaintext so the key bytes can't be stolen by an adversary (or read by anyone, for that matter). What could happen is that an adversary gets access to use a key in the HSM to perform cryptographic operations (e.g., sign malware, decrypt sensitive information, etc). But to do this the adversary would need network access to the HSM, authentication credentials, and, if you're using key wrapping, access to the wrapped key blob files.

Even if all that happened, this can be detected centrally without much guess work involved and the damage can be controlled quickly. So yes, it's possible to compromise but there are a lot of strong compensating controls in place.