Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

tomforb.es

Post reply on HN
Print view View original

41–50 of 218 posts

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#41

Post by smcl »

precompute wrote: post #9

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…

> Cognizant

Someone hired those clowns as contractors as extra in a previous job, to loud protests from our development team. They produced what was quite possibly the most chaotic, copy-paste, typo-laden code I have ever seen in my life.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#43

Post by another_devy »

COMMENT___ wrote: post #39
COMMENT___ wrote: post #38

Earlier quoted context omitted.

Yeah, that's an excerpt from Wikipedia. But when I see these lines I actually read "money laundering" and "scam".

Answer by GPT-3: > How is information security in Infosys? Information security at Infosys is implemented through a combination of technological and organizational measures. The company has a dedicated information security team that works to identify and mitigate risks. Technologies used to protect data include encryption, firewalls, and intrusion detection systems. Organizational measures include employee training o…

> teams that works to identify and mitigate risks

Complete failure by team to not see super user permission as risks

> intrusion detection…

Clearly the did not implement AWS CloudTrail threat detection otherwise when op accessed the account it should have raised alarms, so its just plain lie

> …training on security policy

So the GitHub user probably skipped those considering them boring. And instead of reporting their own failure chose sneaky way to make it go away hoping no one will notice

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#44

Post by COMMENT___ »

dekhn wrote: post #40
COMMENT___ wrote: post #37

This kind of stories is one of the reason I visit Hacker News. Thank you! It's funny and annoying to read every week or so about another epic fail of a multi-billion "multinational information technology company". Good luck with outsourcing your critical services and medical data to neurodivergents. Thanks again for making my day.

I recommend the RISKS mailing list. https://seclists.org/risks/ But note that they sometimes take reliability too far.

Oh, this is great! Thank you.

PS Good old usenet. :)

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#45

Post by MarkMarine »

1024core wrote: post #19

Is it possible to do a full sweep across all tokens in all Python files (for instance) in Github and find such keys? Can you tell from the contents if it's a key or some such "important" string?

Yep, and if you don't look for them, you can be darn sure someone else is looking for them. I heard about an incident from a friend where a GitHub repo was created accidentally public (ran out of private repos and I guess the failure mode back in the day was just make it public) and that repo had developer level access keys in it. Some enterprising fellow was scanning public repos for this, grabbed the keys, opened thousands and thousands of the biggest GPU machines they could get on AWS and started mining bitcoins. They were nice enough not to delete production to make room for more bitcoin miners.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#48

Post by Akronymus »

neathack wrote: post #4

When do companies finally start adopting the `security.txt` proposal (see https://securitytxt.org ). Would have made a big difference! EDIT: That GitHub user is gone for good.

That site is quite ironic.

https://securitytxt.org/security.txt 404's

As does https://securitytxt.org/well-known/security.txt

nvm, I missed a '.'

https://securitytxt.org/.well-known/security.txt

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#49

Post by COMMENT___ »

another_devy wrote: post #43
COMMENT___ wrote: post #39

Earlier quoted context omitted.

Answer by GPT-3: > How is information security in Infosys? Information security at Infosys is implemented through a combination of technological and organizational measures. The company has a dedicated information security team that works to identify and mitigate risks. Technologies used to protect data include encryption, firewalls, and intrusion detection systems. Organizational measures include employee training o…

> teams that works to identify and mitigate risks Complete failure by team to not see super user permission as risks > intrusion detection… Clearly the did not implement AWS CloudTrail threat detection otherwise when op accessed the account it should have raised alarms, so its just plain lie > …training on security policy So the GitHub user probably skipped those considering them boring. And instead of reporting thei…

I believe that the OP of this comment thread has been unfairly downvoted. It was irony, right?

Sigh.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#50

Post by dessant »

precompute wrote: post #9

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…

Fun fact: Mozilla projects are now developed in part by Cognizant Softvision, including Firefox for Android. Their employees are everywhere on Mozilla bug trackers, and their numbers seem to have increased since 2020, right after Mozilla fired a quarter of its workforce.

https://www.cognizantsoftvision.com/blog/pedal-metal-mozilla...

Post reply on HN