Harden-Runner Adds Egress Blocking for macOS and Windows GitHub Runners
Summary
Step Security says Harden-Runner v2.20.0 can block outbound calls to endpoints not on an allowed list on macOS and Windows GitHub-hosted runners, extending a capability previously available on Linux runners.
Key points
- Harden-Runner v2.20.0 adds egress block mode for macOS and Windows GitHub-hosted runners; the article says it was previously supported on Linux runners.
- According to Step Security, calls to endpoints outside the allowed list are blocked, including calls attempted by compromised dependencies, poisoned actions or injected scripts.
- The recommended rollout is to use audit mode, review a policy generated from observed traffic, then switch to block mode.
- The article cites the Megalodon campaign and GhostAction as examples of attacks that exfiltrated secrets through GitHub Actions workflows or dependencies.
- The article highlights Apple signing credentials on macOS runners and code-signing certificates on Windows runners as sensitive assets at risk of exposure.
Article Details
- Event Type
- Harden-Runner v2.20.0 release extending egress block mode to macOS and Windows GitHub-hosted runners.
- Impact
- The update lets teams block outbound calls from macOS and Windows runners unless they match allowed endpoints, extending enforcement previously available on Linux. This can help prevent compromised workflows or dependencies from exfiltrating secrets; the article highlights risks to Apple signing credentials and Windows code-signing certificates.
Vendors
Products
GitHub ActionsThe most damaging GitHub Actions attacks of the past year share one mechanism: a compromised workflow or dependency makes an outbound call and your secrets leave with it. The Megalodon campaign exfiltrated secretsHarden-RunnerHarden-Runner v2.20.0 extends egress block mode to macOS and Windows GitHub-hosted runners, so you can stop secret exfiltration on every OS your pipelines run on, not just observe it.