Incident Score: Analysis & Impact (CROTAN1789971988)

In this Rankiteo incident briefing, we review the CrowdSec breach identified under incident ID CROTAN1789971988.

The analysis begins with a detailed overview of CrowdSec's information like the linkedin page: https://www.linkedin.com/company/crowdsec, the number of followers: 14350, the industry type: Computer and Network Security and the number of employees: 30 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 749 and after the incident was 674 with a difference of -75 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on CrowdSec and their customers.

On 16 September 2024, CrowdSec disclosed Supply Chain Attack issues under the banner "CrowdSec Repositories Compromised via Stolen GitHub OAuth Token in Supply Chain Attack".

In a supply chain attack linked to the TanStack npm compromise, threat actors TeamPCP (UNC6780) exploited a stolen GitHub OAuth token to clone 170 private CrowdSec repositories, exposing source code, limited user contact details, and a restricted AWS credential.

The disruption is felt across the environment, affecting 170 private repositories, SaaS console code, automation tools, Consensus Algorithm, and exposing Source code, limited user contact details, restricted AWS credential, with nearly 170 repositories, 83 user email addresses records at risk.

In response, teams activated the incident response plan, moved swiftly to contain the threat with measures like Account removal, credential rotation, token revocation, and began remediation that includes Forensic reviews, notifications to affected individuals, and stakeholders are being briefed through Public disclosure on September 16.

The case underscores how Completed (forensic review), teams are taking away lessons such as Risks in developer credential exposure, need for stricter offboarding controls and faster incident response, with advisories going out to stakeholders covering Notifications sent to affected individuals.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.