Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

humankode.com

Post reply on HN
Print view View original

1–10 of 110 posts

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#4

Post by TimothyFitz »

mahouse wrote: post #3

Are we really going to run this story every month? "I posted my private AWS keys by mistake on github, a spider got them, I got a huge bill" Yeah, you don't say

He didn't post it by mistake. He asked Visual Studio to create a private repo and it created a public one. A bug which he reproduced.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#5

Post by Analemma_ »

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to follow up.

Same thing with GitHub. When they see an AWS key, they need to block that push and send back a message saying "If you're really, really, REALLY sure you want to do this, add .allowawskey at the root of your commit and push again". There's no excuse for letting people shoot themselves in the foot like this over and over.

(Edited for typo)

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#6

Post by tonywebster »

mahouse wrote: post #3

Are we really going to run this story every month? "I posted my private AWS keys by mistake on github, a spider got them, I got a huge bill" Yeah, you don't say

Don't be so quick to dismiss this one. This is notable for several reasons, including (1) it wasn't his mistake, but rather that of a Visual Studio bug not following his instructions to make a private repo on GitHub; (2) the speed in which this happened (minutes), and (3) it has useful analysis into some sorely lacking functionality in AWS that lets this continue to happen.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#7

Post by famousactress »

"As a senior developer with over 12 years of experience in the financial services industry, I didn't think it was possible that I could be the victim of a data breach."

We're only one sentence in and I'm already very, very nervous about the author's hubris.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#9

Post by tomschlick »

mbrutsch wrote: post #8
ocdtrekkie wrote: post #2

I still find it amazing that AWS doesn't offer any way to hardcap your billing and cut off service.

There's really no financial incentive to do so.

There is when they keep refunding people for having their account hijacked and on the other end are giving away CPU resources to the bitcoin miners.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#10

Post by vacri »

Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

AWS do do things. They have service limits and routinely waive charges from abuse events like this.

I do wonder if GitHub's events firehose has benefits that outweigh all the compromised credentials, though. Not just limited to AWS keys.

Post reply on HN