Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

humankode.com

Post reply on HN
Print view View original

31–40 of 110 posts

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#31

Post by RussianCow »

Alupis wrote: post #24
Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

Is it really on the web service companies to make sure you (the developer) don't do anything stupid? The article author could have avoided a lot of headache if he simply checked the repo before walking away. Red flags should have gone up as soon as he received the first weird Amazon messages, but he still didn't think to check his own work. The author calls this a "Data Breach" but in reality it was a "Data Leak".

Amazon would save some money by doing this, since they usually reimburse "victims" of public AWS keys (at least on the first instance) and eat the cost.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#34

Post by ohashi »

tomschlick wrote: post #9
mbrutsch wrote: post #8

Earlier quoted context omitted.

There's really no financial incentive to do so.

There is when they keep refunding people for having their account hijacked and on the other end are giving away CPU resources to the bitcoin miners.

Here's a hypothetical, what is the real cost, he said they were using spot instances too. A huge spike in demand might have an effect on price, pushing the cost up for all legitimate users. As far as the reserved instances, they were there, not being used presumably. They don't really lose anything except possibly some electricity and bandwidth costs?

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#35

Post by basch »

Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

obviously someone is good at detecting it considering 6.5k in usage got racked up with data scraped within 10 minutes of commit

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#36

Post by tomphoolery »

famousactress wrote: post #7

"As a senior developer with over 12 years of experience in the financial services industry, I didn't think it was possible that I could be the victim of a data breach." We're only one sentence in and I'm already very, very nervous about the author's hubris.

Right? Who spends 12 years in the software industry and doesn't actually test their work after doing shit?

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#37

Post by merb »

Why does somebody pushes AWS Keys into a Git Repository? Why should somebody ever push some Authentications? Currently when I code an app I create a database with name of the app and have new credentials with just name:name so that the only thing that I check into my config if the app needs a application.conf or resource.conf are default username:passwords for development, so that bootstrapping is easier. However EVERYTHING else gets read from the Environment Variables that even Works on Windows since Visual Studio has a Feature for that, but be aware the sln file we keep the values. So however never ever put anything into git / source code repo which shouldn't be read.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#38

Post by tomphoolery »

Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

"letting people shoot themselves in the foot like this over and over"

Stop doing it in the first place, problem solved. I don't see why GitHub or Amazon need to hold my hand through a serious process. It would diminish the importance of what you're doing.

Also, this guy didn't just use AWS keys...he clearly used AWS master keys...which has not been the recommended course of action for AT LEAST THREE YEARS...if he had used a proper IAM user with only the access he needed, this wouldn't have happened. Sorry, but that was just irresponsible.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#39

Post by mhuffman »

Alupis wrote: post #24
Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

Is it really on the web service companies to make sure you (the developer) don't do anything stupid? The article author could have avoided a lot of headache if he simply checked the repo before walking away. Red flags should have gone up as soon as he received the first weird Amazon messages, but he still didn't think to check his own work. The author calls this a "Data Breach" but in reality it was a "Data Leak".

Maybe not, but it think it is the web service company's responsibility to alert and contact you on suspicious activity ... like a sudden $6,000 jump in service usage of spot instances in regions you have never used before.

I mean a quick automated email would be enough for you to take action. The way it is set up now, you pay for it and humbly beg Amazon to deduct those charges if they see fit.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#40

Post by onion2k »

Alupis wrote: post #24
Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

Is it really on the web service companies to make sure you (the developer) don't do anything stupid? The article author could have avoided a lot of headache if he simply checked the repo before walking away. Red flags should have gone up as soon as he received the first weird Amazon messages, but he still didn't think to check his own work. The author calls this a "Data Breach" but in reality it was a "Data Leak".

Is it really on the web service companies to make sure you (the developer) don't do anything stupid?

Yes. The web service company should look at it as basic security - if people are using their service to discover private information and use it to defraud their users, even if the users have been stupid enough to upload that information publicly, the company should do what they can to mitigate the problem.

If I post a photo of my credit card on Twitter I would expect my bank to limit the damage as much as possible by declining obviously fraudulent transactions. Ultimately it's my own fault, and I would be liable for the costs, but that doesn't mean the bank should just let it happen if they can do something to stop it.

Post reply on HN