Toyota suffered a data breach by accidentally exposing a secret key on GitHub
blog.gitguardian.com
Toyota suffered a data breach by accidentally exposing a secret key on GitHub
1–10 of 272 posts
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#2"Production keys in source control" is right up there with "mistaken routing table entry" and "fat-fingered DNS config" on the list of critical company-breaking mistakes that you'd think would be easy to avoid, but aren't.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#3The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#4The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...
I don't think it is flawed.
You cannot access org's repos without VPN
if you create a new repo by mistake outside your org, then uhh..., it's crazy?
it's like sending email with credentials to people outside your org
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#5"Production keys in source control" is right up there with "mistaken routing table entry" and "fat-fingered DNS config" on the list of critical company-breaking mistakes that you'd think would be easy to avoid, but aren't.
Add "failure to rotate TLS certs before they expire."
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#6> T-Connect enables features like remote starting, in-car Wi-Fi, digital key access,
Could an attacker have remote-unlocked and remote-started the entire Toyota fleet with this access?
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#7The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...
I don't see how this is related to GitHub's access model. Was the canonical Toyota repo even on GitHub?
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#8Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I thought that was very proactive and excellent customer service.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#9The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...
Oh yes this. It's so easy to critically fuck up an invite into an organisation. If you get typo the username you are potentially compromised. I've seen a couple of near misses on this already.
Note: the invite input box actually autocompletes ALL github usernames.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#10> T-Connect enables features like remote starting, in-car Wi-Fi, digital key access, Could an attacker have remote-unlocked and remote-started the entire Toyota fleet with this access?
Toyota is claiming no, not with this leak. It was a partial repo that was exposed. The data they accessed with the key got customer ID numbers and emails only.