Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

41–50 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#41

Post by Natsukvshii »

danielodievich wrote: post #8

Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I tho…

I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it.

I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#42

Post by [deleted] »

danielodievich wrote: post #8

Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I tho…

[deleted]

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#43

Post by ElevenLathe »

deathanatos wrote: post #29
ElevenLathe wrote: post #5

Earlier quoted context omitted.

Add "failure to rotate TLS certs before they expire."

My company has monitoring for this, but it still seems to be a law of nature that, 1. someone adds new service/server/infra in a submarine manner 2. it goes to prod 3. the cert expires and outage begins 4. my team is asked what to do, because "we're the cert experts" 5. we add it to the monitoring So it only happens once … per service. Which isn't great. But how do you get people to slow down and do simple shit, like…

I think the real answer is to only issue limited-duration certs and only via automated means (ACME or similar), thus requiring automation be in place from day 1.

This still doesn't protect against the vector where somebody else in the company has managed to prove themselves to be responsible parties to another CA/issuer.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#44

Post by robswc »

coenhyde wrote: post #31
deathanatos wrote: post #24

Earlier quoted context omitted.

And yet I see it get violated all the time. People should do a lot of things, but a lot of my coworkers are lazy and do not do quality work. Given that it happens, and that I can't prevent it, one must then ask how to guard against it. At my org, we even try to generate all secrets with a standardize prefix/suffix so as to make them very greppable. That doesn't stop "Architects", "Customer Solutions", "Analytics" typ…

Doctors used to not wash their hands too. I get it though, and i've seen the same thing. Really it comes down to education and not granting access to secrets to people who aren't capable of handling them.

"fun" fact - there could potentially be thousands of deaths attributed to Drs simply not washing their hands.

IIRC they even basically got some hospital admin fired for creating a hand washing mandate, despite it being proven to save lives.

https://www.npr.org/sections/health-shots/2015/01/12/3756639...

(talking centuries ago, but maybe even today)

Looks like its still a "recent" issue, lol https://www.nytimes.com/2006/09/24/magazine/24wwln_freak.htm...

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#45

Post by eax-eip »

Most of these (even sometimes expensive) tools only look at repos and users who are associated with the company’s GitHub org, which barely solves the problem. The much harder problem is the number of corporate secrets that are on random repositories (personal dotfiles, automations, data science scripts, etc.) across GitHub with no strong relationship to the organization. Try using GitHub Code Search to find all the Fastly API tokens that have been leaked, for example, and I bet you’d find some wild stuff.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#46

Post by coenhyde »

ajross wrote: post #34
coenhyde wrote: post #13

Earlier quoted context omitted.

Those three are not all equal. "Production keys in source control" is the equivalent of a surgeon not washing their hands between between surgeries. It's basic level of professional competency that should not be violated. The latter two are bad mistakes, which shouldn't happen but do.

"Should" not be violated is the point, though. I agree, it shouldn't. But it is, all the time. I mean, I'll bet Toyota knew this organizationally. They had security people sign off on the design who all knew how secure key management is supposed to work. They probably reviewed this github release. And it happened anyway. Maybe they weren't supposed to be production keys. Maybe it was a development key from someone's…

You're jumping to conclusions in your final statement there. The existence of inexcusable bad practices does not mean we should not try to mitigate against them, and I didn't say we shouldn't.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#47

Post by lumberjack24 »

dinvlad wrote: post #18

I wish hosted GitHub made pre-push hooks available to the public. Would make this a much easier problem with free scanning tools like Trufflehog. Or alternatively, if GitHub Secret Scanning was available to all public repos, instead of requiring a (very) expensive GitHub Advanced Security subscription. But I understand, they need to make money somehow.

In the meantime, try ggshield cli https://github.com/GitGuardian/ggshield

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#48

Post by chaps »

gw99 wrote: post #23
chaps wrote: post #11

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…

This shit happens all the time. Old school one when I was a security consultant for a bit (pre-automated pentest scammers). Medium size regulated fintech. Domain admin passwords and admin accounts were stuck on post it notes on a board in the machine room. If you went over the road to the college, asked to use the toilet, which they seemed fine with, and poked your 200mm lens out of the bathroom window you could snap…

Yep :)

Did some consulting for an org that did managed IT and found that they wrote on a white board all of their passwords. Wrote them an email basically telling them "hey maybe you should erase that". May or may not have billed them for the time it took to write that email.

They put a piece of paper over the passwords in response.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#49

Post by [deleted] »

deathanatos wrote: post #29
ElevenLathe wrote: post #5

Earlier quoted context omitted.

Add "failure to rotate TLS certs before they expire."

My company has monitoring for this, but it still seems to be a law of nature that, 1. someone adds new service/server/infra in a submarine manner 2. it goes to prod 3. the cert expires and outage begins 4. my team is asked what to do, because "we're the cert experts" 5. we add it to the monitoring So it only happens once … per service. Which isn't great. But how do you get people to slow down and do simple shit, like…

[deleted]

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#50

Post by HL33tibCe7 »

deathanatos wrote: post #29
ElevenLathe wrote: post #5

Earlier quoted context omitted.

Add "failure to rotate TLS certs before they expire."

My company has monitoring for this, but it still seems to be a law of nature that, 1. someone adds new service/server/infra in a submarine manner 2. it goes to prod 3. the cert expires and outage begins 4. my team is asked what to do, because "we're the cert experts" 5. we add it to the monitoring So it only happens once … per service. Which isn't great. But how do you get people to slow down and do simple shit, like…

“If you keep smelling shit, look at your own shoe”.

Your processes are failing your development teams, and you need to fix them, rather than blaming your teams, which achieves nothing.

Post reply on HN