Question: Let's say I want to open source my app but a long time ago I used to have credentials hard coded. What can I do to clean this up from history?
Toyota suffered a data breach by accidentally exposing a secret key on GitHub
91–100 of 272 posts
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#92Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I tho…
I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.
I’ve had this happen to me too! No less than a second after pushing to GitHub did I receive a message about publicizing my auth key. It was amazing, and I’m sure this saves a lot of stolen keys from people just getting into programming
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#93Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I tho…
Github supports this out of the box – https://docs.github.com/en/code-security/secret-scanning/abo... , and recognizes tokens from a lot of services.
In fact, you can apply as a Github "secret scanning partner" to have your own secret's format (regexp) be a part of this secret scanning, with a webhook to your servers whenever they find one, so that you can do the credential-invalidation on your own backend + send the kindly-worded email from your own domain.
Mind you, your secrets need to have a distinctive format in order for this to work. Probably a distinctive prefix is enough.
An Unethical Life Pro-Tip (that the word is already out on anyway, so I don't feel too bad):
• The content of Github public repos is all continuously loaded (by Github themselves) as a public dataset into BigQuery — https://console.cloud.google.com/marketplace/details/github/....
• For about $500, you can use BigQuery to extract all matches of a particular regexp, from every file, in every commit, in every public Github repo.
Whether or not Github themselves use this to power their secret scanning, arbitrary third parties (benevolent or not) certainly can use it for such. And likely already do.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#94Question: Let's say I want to open source my app but a long time ago I used to have credentials hard coded. What can I do to clean this up from history?
Git does have tools that allow you to rewrite history to fix situations like this, but by far the easiest solution is to invalidate those credentials so they become worthless.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#95Earlier quoted context omitted.
I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.
GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...
Top proactive security feature of the year, for me. Nice stuff.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#96Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…
This shit happens all the time. Old school one when I was a security consultant for a bit (pre-automated pentest scammers). Medium size regulated fintech. Domain admin passwords and admin accounts were stuck on post it notes on a board in the machine room. If you went over the road to the college, asked to use the toilet, which they seemed fine with, and poked your 200mm lens out of the bathroom window you could snap…
Everyone complains about post-it notes, but the physical proximity requirement to read them isn't nothing. E.g. compared to network-accessible files.
At least, until you have a network-attached webcam pointed at your whiteboard.
But the solution to the webcam problem is to write its access credentials on your whiteboard, thus forming a circular and perfectly secure loop.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#97Earlier quoted context omitted.
Github supports this out of the box – https://docs.github.com/en/code-security/secret-scanning/abo... , and recognizes tokens from a lot of services.
In fact, you can apply as a Github "secret scanning partner" to have your own secret's format (regexp) be a part of this secret scanning, with a webhook to your servers whenever they find one, so that you can do the credential-invalidation on your own backend + send the kindly-worded email from your own domain. Mind you, your secrets need to have a distinctive format in order for this to work. Probably a distinctive…
Does GitHub not postpone publishing new verisons until after the secret scanning is done?
Also I'd hope that Google is scanning BigQuery queries for that abuse signal.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#98Earlier quoted context omitted.
This shit happens all the time. Old school one when I was a security consultant for a bit (pre-automated pentest scammers). Medium size regulated fintech. Domain admin passwords and admin accounts were stuck on post it notes on a board in the machine room. If you went over the road to the college, asked to use the toilet, which they seemed fine with, and poked your 200mm lens out of the bathroom window you could snap…
Everyone complains about post-it notes, but the physical proximity requirement to read them isn't nothing. E.g. compared to network-accessible files. At least, until you have a network-attached webcam pointed at your whiteboard. But the solution to the webcam problem is to write its access credentials on your whiteboard, thus forming a circular and perfectly secure loop.
Perfectly circular 0 the first time you join a meeting.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#99Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…
Yikes. It is sad to hear stories like that, where security is not a concern until panic sets in. :( Yet another reason we need to adopt standards like security.txt and make it easy to report these things as it is to tell robots to ignore us with robots.txt. See securitytxt.org for more on the project.
It's tough. I'm our public security reporting email list.
We get a lot of things that boil down to "When I go to your website, I am able to see the content of your html files!" ... yes, reporter. That is what a web server does. It gives you HTML files. Congrats that you have figure out the dev console on your browser, but you're not a hacker. I'm trying to go with Hanlon's razor here and assume this is inexperienced people and not outright scams.
We don't get a lot of these, but they far outweigh actual credible reports. But we try our best and take everything seriously until it can get disproven. And it's exhausting. So I get it sometimes. Sometimes having a place for responsible disclosure just opens yourself up to doing more paperwork (verifying that the fake reports are fake). That said, we still do it.
Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub
#100Earlier quoted context omitted.
Github supports this out of the box – https://docs.github.com/en/code-security/secret-scanning/abo... , and recognizes tokens from a lot of services.
In fact, you can apply as a Github "secret scanning partner" to have your own secret's format (regexp) be a part of this secret scanning, with a webhook to your servers whenever they find one, so that you can do the credential-invalidation on your own backend + send the kindly-worded email from your own domain. Mind you, your secrets need to have a distinctive format in order for this to work. Probably a distinctive…
The GitHub public events API is delayed by 5 minutes, presumably to give secret scanning partners time to react before commits are made public.
https://github.blog/changelog/2018-08-01-new-delay-public-ev...
Disclosure: I'm an ex-GitHub employee but was not involved in the secret scanning API.