Lol, I love how he just opted to delete it. Great on ya for having some balls instead of walking on eggshells like most of these security back and forth dialogues.
Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
11–20 of 218 posts
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#12Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved…
The lesson here is that there are things worse than downtime. Yeah the site being down is bad but hey, what's worse? Leaking PII all over the place.
I tried to highlight this in the post, but the key is a personal user one tied to an email, and the worst that I expect would happen would be that some training scripts break.
If this was a production key or something that seemed like it would cause financial harm/downtime, I would have never deleted it.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#13[dead]
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#14> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…
>No competent employee stays in those companies
Absolutely true from first hand experience.
Imagine being a top performer doing great work for a company whose managers insist on wasting your time putting you into needless meetings getting you to explain how you're doing everything all through badly communicated text with typos and misspellings.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#15Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved…
Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.
Not in my experience dealing with customers who had AWS email them saying 'Hey, we found one of your keys on GitHub'.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#16Earlier quoted context omitted.
The lesson here is that there are things worse than downtime. Yeah the site being down is bad but hey, what's worse? Leaking PII all over the place.
I tried to highlight this in the post, but the key is a personal user one tied to an email, and the worst that I expect would happen would be that some training scripts break. If this was a production key or something that seemed like it would cause financial harm/downtime, I would have never deleted it.
Honestly, with this level of competence I wouldn't be surprised if the same admin user credentials were used in application/lambda processor/whatever there is. Not at all saying you shouldn't have done it though!
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#17Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved…
Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.
That evidently didn't happen here.
I do remember reading about that too though, maybe it missed it because it was JSON data not a variable definition or something?
https://docs.github.com/en/code-security/secret-scanning/sec...
I can't find anywhere that specifies the actual pattern though.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#18Earlier quoted context omitted.
Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.
That evidently didn't happen here. I do remember reading about that too though, maybe it missed it because it was JSON data not a variable definition or something? https://docs.github.com/en/code-security/secret-scanning/sec... I can't find anywhere that specifies the actual pattern though.
it wasn't stored on GitHub.
there's a json file on GitHub referencing the download of the source archive, stored on pypi infra.
in the tgz you can download from pypi you can find python code containing the secret.
https://github.com/orf/pypi-data/blob/main/release_data/i/h/...
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#19Is it possible to do a full sweep across all tokens in all Python files (for instance) in Github and find such keys? Can you tell from the contents if it's a key or some such "important" string?
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#20Their entire cybersecurity page is just a bunch of gibberish. It's like someone slapped together buzzwords and phrases until they filled a word count.
Probably GPT-3 generated...