Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

171–180 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#171

Post by ls15 »

psaux wrote: post #154
greysteil wrote: post #56

Earlier quoted context omitted.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

I had a couple questions, as this feature is awesome! How long does it take to get the response vs external bots pulling the data? What mechanisms does GitHub have in place to stop bots who monitor repo changes? I ask, as I have been there and it is super scary how fast someone/bot pulls repo data changes, as in minutes, and the repo we had back then was not popular.

As long as search results can be sorted by date, anyone can see updates pretty much instantly if they monitor the search results. The repos don't have to be popular for that. Bots can just check such a feed every few seconds for example.

https://github.com/search?o=desc&q=secret&s=updated&type=Rep...

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#172

Post by paradite »

I have an idea:

What if companies using secret keys (not SaaS providers who generate secret keys) voluntarily send their secret keys (MD5 hashed or somehow encrypted) to GitHub and GitHub can then monitor their leakage and notify the company?

Is this useful or feasible?

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#173

Post by AtNightWeCode »

> A credential for a DB server holding customer data was hardcoded into the repo.

This is normally not a problem since databases should not be exposed to everyone one the Internet.

> One of the benefits of Git is that everyone has a complete copy of the project they are working on.

This is one of the problems with GIT and many programming langs. Because of this full copies of entire code bases are everywhere. GIT also only has ACL on repo level.

In many langs it is recommended to not store credentials in the code but at the same time there are no guidelines for how to store credentials. If you use cloud services there are recommendations.

Edit: Btw, which git service where they using? Cause I believe Github and others monitor code bases for accidental pushes of secrets.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#174

Post by devcat »

paradite wrote: post #172

I have an idea: What if companies using secret keys (not SaaS providers who generate secret keys) voluntarily send their secret keys (MD5 hashed or somehow encrypted) to GitHub and GitHub can then monitor their leakage and notify the company? Is this useful or feasible?

Github already has system to invalidate tokens without storing any hashes themselves https://docs.github.com/en/code-security/secret-scanning/sec...

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#175

Post by rytis »

gl-prod wrote: post #170
comboy wrote: post #143

Earlier quoted context omitted.

TIL: make private key for your service easy to match with regexps

Yeah, prefixing your keys with your service name like SRVCE_{KEY} is the way to go. Bonus: adding SRVCE_PRVT_{KEY} and SRVCE_PUB_{KEY}.

And while we're at it, I think saving two chars isn't going to do much to prevent global warming, and let's just use more readable SERVICE_{KEY} and SERVICE_PUB_{KEY} (as opposed to having scratch your head thinking "did I call it SRV, SVC, SRVC, SRVCE, ...?")

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#176

Post by paradite »

devcat wrote: post #174
paradite wrote: post #172

I have an idea: What if companies using secret keys (not SaaS providers who generate secret keys) voluntarily send their secret keys (MD5 hashed or somehow encrypted) to GitHub and GitHub can then monitor their leakage and notify the company? Is this useful or feasible?

Github already has system to invalidate tokens without storing any hashes themselves https://docs.github.com/en/code-security/secret-scanning/sec...

Yes. This is dependent on some kind of agreement or understanding between SaaS provider and GitHub.

I'm thinking of a generic approach which is independent of where you got the secret key and its format.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#177

Post by Gibbon1 »

AtNightWeCode wrote: post #173

> A credential for a DB server holding customer data was hardcoded into the repo. This is normally not a problem since databases should not be exposed to everyone one the Internet. > One of the benefits of Git is that everyone has a complete copy of the project they are working on. This is one of the problems with GIT and many programming langs. Because of this full copies of entire code bases are everywhere. GIT als…

I tool I would like, and likely linker magic could handle this, is a standard tool to patch elf files with things like revision info and keys[1].

[1] Notable, friend in the security biz had the advice that stored keys and passwords should never just work.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#178

Post by devcat »

paradite wrote: post #176
devcat wrote: post #174

Earlier quoted context omitted.

Github already has system to invalidate tokens without storing any hashes themselves https://docs.github.com/en/code-security/secret-scanning/sec...

Yes. This is dependent on some kind of agreement or understanding between SaaS provider and GitHub. I'm thinking of a generic approach which is independent of where you got the secret key and its format.

Same system can be applied for repo owner being pattern provider and getting notified with matches but if i had to guess only enterprise customers might get feature like this

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#179

Post by fragmede »

josephg wrote: post #129
greysteil wrote: post #109

Earlier quoted context omitted.

It's totally free - there are details of how to join the program at https://docs.github.com/en/developers/overview/secret-scanni...

Hm - this would work better if keys were easy to scan with regular expressions. Next time I implement api keys I wonder if it’s worth going out of my way to make them easy to identify. Eg, by prefixing every key with a few well known characters. Like FMLA_xxxxx for a fastmail app key.

It's absolutely worth it, for everyone's sanity involved.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#180

Post by elguyosupremo »

sidewndr46 wrote: post #122
lumberjack24 wrote: post #78

Earlier quoted context omitted.

GitGuardian actually does this, it monitors an extended perimeter of devs and their personal/open-source repos for corporate secrets or keywords – https://www.gitguardian.com/monitor-public-github-for-secret...

Yeah, because as an employee what I totally want is my employer to monitor my every digital move outside of work!

Make a private repo. I wouldn't blame a corp if they tried to scan every public github repo for their API keys, let alone an employee's public account.
Post reply on HN