Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

11–20 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#11

Post by chaps »

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security.

A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a commit in their repo that included a production password and sent it to him. Maybe took 5-10 minutes to find? Apparently once they found out about the commit, they panicked a bit and started taking his concerns more seriously.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#12

Post by HWR_14 »

ElevenLathe wrote: post #5
ajross wrote: post #2

"Production keys in source control" is right up there with "mistaken routing table entry" and "fat-fingered DNS config" on the list of critical company-breaking mistakes that you'd think would be easy to avoid, but aren't.

Add "failure to rotate TLS certs before they expire."

But at least that failure just makes the services fail, not opens a security hole.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#13

Post by coenhyde »

ajross wrote: post #2

"Production keys in source control" is right up there with "mistaken routing table entry" and "fat-fingered DNS config" on the list of critical company-breaking mistakes that you'd think would be easy to avoid, but aren't.

Those three are not all equal. "Production keys in source control" is the equivalent of a surgeon not washing their hands between between surgeries. It's basic level of professional competency that should not be violated. The latter two are bad mistakes, which shouldn't happen but do.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#14

Post by matai_kolila »

gw99 wrote: post #9
lumberjack24 wrote: post #3

The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...

Oh yes this. It's so easy to critically fuck up an invite into an organisation. If you get typo the username you are potentially compromised. I've seen a couple of near misses on this already. Note: the invite input box actually autocompletes ALL github usernames.

> Note: the invite input box actually autocompletes ALL github usernames.

I'm sorry, but that's wild. That's like, not even an easy engineering problem to solve necessarily, given their size!

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#17

Post by mcdwayne »

chaps wrote: post #11

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…

Yikes. It is sad to hear stories like that, where security is not a concern until panic sets in. :(

Yet another reason we need to adopt standards like security.txt and make it easy to report these things as it is to tell robots to ignore us with robots.txt. See securitytxt.org for more on the project.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#18

Post by dinvlad »

I wish hosted GitHub made pre-push hooks available to the public. Would make this a much easier problem with free scanning tools like Trufflehog.

Or alternatively, if GitHub Secret Scanning was available to all public repos, instead of requiring a (very) expensive GitHub Advanced Security subscription. But I understand, they need to make money somehow.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#19

Post by wereHamster »

ajross wrote: post #2

"Production keys in source control" is right up there with "mistaken routing table entry" and "fat-fingered DNS config" on the list of critical company-breaking mistakes that you'd think would be easy to avoid, but aren't.

> Production keys in source control

IaC, right? If you don't put keys into the Code you can't have Infrastructure as Code. Without keys the code only partially defines your infrastructure.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#20

Post by jrockway »

> Git is an awesome version control system, used by over 93% of developers, and is at the heart of modern CI/CD pipelines. One of the benefits of Git is that everyone has a complete copy of the project they are working on.

I feel like this is copy-pasted from a pitch deck on why GitGuardian should be funded. Does anyone reading the article care about this anecdote? Like do people stop reading at "well I'm one of the 7% that doesn't" or think "wow a lot of people are using Git, I should buy their thing"?

Sorry for the meta comment, but it just stuck out as odd to me.

Post reply on HN