Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

141–150 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#141

Post by autoexec »

mcdwayne wrote: post #17
chaps wrote: post #11

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…

Yikes. It is sad to hear stories like that, where security is not a concern until panic sets in. :( Yet another reason we need to adopt standards like security.txt and make it easy to report these things as it is to tell robots to ignore us with robots.txt. See securitytxt.org for more on the project.

Most respectable services will have an abuse@ address you can contact. They should at least be able to get your issues where they need to go internally. I've had very good results for companies and networks in the US.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#142

Post by gwbas1c »

gw99 wrote: post #23
chaps wrote: post #11

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…

This shit happens all the time. Old school one when I was a security consultant for a bit (pre-automated pentest scammers). Medium size regulated fintech. Domain admin passwords and admin accounts were stuck on post it notes on a board in the machine room. If you went over the road to the college, asked to use the toilet, which they seemed fine with, and poked your 200mm lens out of the bathroom window you could snap…

I used to put fake password stickies on my monitor at my first job out of school. No one ever said anything.

My current manager is delightfully paranoid about security, so maybe I'll do it again to see if he says anything.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#143

Post by comboy »

greysteil wrote: post #56
Natsukvshii wrote: post #41

Earlier quoted context omitted.

I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

TIL: make private key for your service easy to match with regexps

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#144

Post by nijave »

josephg wrote: post #129
greysteil wrote: post #109

Earlier quoted context omitted.

It's totally free - there are details of how to join the program at https://docs.github.com/en/developers/overview/secret-scanni...

Hm - this would work better if keys were easy to scan with regular expressions. Next time I implement api keys I wonder if it’s worth going out of my way to make them easy to identify. Eg, by prefixing every key with a few well known characters. Like FMLA_xxxxx for a fastmail app key.

Some services also use prefixes to provide additional context like account type and token validity length. I think Slack does this (service accounts have different prefixes than user accounts and I think temporary tokens have another prefix)

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#146

Post by count »

matai_kolila wrote: post #14
gw99 wrote: post #9

Earlier quoted context omitted.

Oh yes this. It's so easy to critically fuck up an invite into an organisation. If you get typo the username you are potentially compromised. I've seen a couple of near misses on this already. Note: the invite input box actually autocompletes ALL github usernames.

> Note: the invite input box actually autocompletes ALL github usernames. I'm sorry, but that's wild. That's like, not even an easy engineering problem to solve necessarily, given their size!

It blew my mind after upgrading to enterprise that was still how it worked.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#147

Post by nijave »

chaps wrote: post #11

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…

Worked at a place where they liked to use encrypted Java prop files... with the passwords hard coded in the app (in the same repo). Those were internal repositories, though.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#148

Post by gumby »

jaywalk wrote: post #118
gumby wrote: post #112

Why would Toyota need to have that info to provide service? We need to get PII as a liability on companies’ balance sheets to get them to take it seriously and to collect only the minim viable data.

Why would they need to have > customer identification numbers and emails to provide service? Seriously?

Yes, seriously. They need to service the vehicle, OK, but communicate to and through the vehicle.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#149

Post by hyperdimension »

nijave wrote: post #147
chaps wrote: post #11

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…

Worked at a place where they liked to use encrypted Java prop files... with the passwords hard coded in the app (in the same repo). Those were internal repositories, though.

Internal...until they aren't. :/

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#150

Post by [deleted] »

crazygringo wrote: post #106
fny wrote: post #104

Is there any reason why keys don't constantly update? It seems like a service could exist where every five minutes a rotation occurs across services with decaying privileges. For example, the 5 minute old key still works, but the 10 minute woman has completely expired.

How would you update the keys every 5 min? Either you'd use an encryption algorithm that depended on a "deeper" key... or you'd fetch the new key while authenticated with, you guessed it, another "deeper" key. It's keys all the way down. Every key you use, it's your responsibility to keep it private. (Unless you want to be dealing with physical hardware dongles that generate keys, but those aren't exactly easily port…

[deleted]
Post reply on HN