TechPrufer
Sign inGet started

Blogs›GitLab›IDE Attack Prevention

IDE Attack Prevention

IDE Attack Prevention

5
posts
2021–2026

GitLab's Security Operations team has developed custom controls to detect and prevent malware campaigns that leverage IDE tasks for distribution, specifically addressing the 'Contagious Interview' threat campaign. This involves low-level detection mechanisms focusing on subprocess execution within IDEs like VS Code, aiming to protect GitLab workstations and customers from malicious code execution that can lead to infostealers, credential theft, and persistence establishment. This post details the technical implementation of these controls, including the use of tooling like gitrob and token hunter for secret discovery, and the emulation of endpoint exploitation and persistence scenarios. The team also leverages GitLab for managing TTPs and running custom attack tooling via CI jobs, outputting results to a secure GitLab Pages site. Collaboration with AppSec and infrastructure teams is emphasized, with shared chat channels for live operation monitoring. The team breaks down the stigma of red teaming by prioritizing transparency, documenting test plans, and involving stakeholders, framing findings as opportunities for improvement.

2026

How to detect and prevent Contagious Interview IDE attacks

5/4/2026

This post details the development of custom controls to prevent IDE task-based attacks, specifically those used by the 'Contagious Interview' threat campaign. The technical contribution involves identifying the `node-pty.spawn()` library and its `spawn-helper` binary as a key area for detection. Detections are tuned to identify background subprocesses spawned without user knowledge, distinguishing them from legitimate foreground processes. This approach aims for low-level, difficult-to-bypass detection that is effective across VS Code and its forks. Proactive measures like disabling task runs globally or educating users are also discussed.

GitLab Threat Intelligence Team reveals North Korean tradecraft

2/19/2026

This post details North Korean threat actors' tradecraft, including the use of JavaScript-based malware (BeaverTail, Ottercookie), custom obfuscation techniques, abuse of legitimate services for payload hosting (e.g., Vercel), and the use of VS Code tasks for malware execution. It also highlights the parallel operation of distinct threat actor teams and the technical proficiency variations observed.

2023

Use GitLab and MITRE ATT&CK Navigator to visualize adversary techniques

8/9/2023

This post details how to use GitLab and the MITRE ATT&CK Navigator to visualize adversary techniques. It provides an example project that deploys the ATT&CK Navigator web application pre-populated with custom annotated matrices, enabling users to visualize their coverage of techniques across the ATT&CK framework. The post explains the MITRE ATT&CK framework, how to fork the example project, and how the underlying components (gitlab-ci.yml, create-layers.py, build-navigator.sh) work together to build and host the static website using GitLab Pages. It also highlights additional features of the ATT&CK Navigator app for visualizing coverage.

2021

Why are developers so vulnerable to drive-by attacks?

9/7/2021

This post details a specific instance of a drive-by RCE attack against the GitLab Development Kit (GDK) by chaining vulnerabilities in Better Errors and webpack-dev-server. It explains how improper content type validation and lack of CSRF protection in Better Errors, combined with webpack-dev-server's permissive CORS configuration, allowed for arbitrary code execution. The post also provides a general explanation of drive-by attacks, CORS preflight requests, simple requests, and the importance of proper origin validation and CSRF protection.

You asked, and our Red Team answered

1/29/2021

This post details the Red Team's approach to endpoint security and credential hunting, including the development and use of tools like gitrob and token hunter. It also describes their methodology for simulating insider threats and assumed breach scenarios, and how they use GitLab and Vectr for managing testing intelligence. The post highlights their collaborative approach with other security and application groups, and their strategies for building trust and breaking down the stigma associated with red teaming within the organization. It also touches on mimicking known TTPs from frameworks like MITRE ATT&CK and tailoring them to GitLab's environment.