I applaud any bad press on InfoSys.
I picked up contract gig through them a few years ago. Here are some of the takeaways from my short lived experience:
- It took them over two weeks to send me a computer.
- They cancelled PTO for everyone. (this was the most egregious single thing they did)
- They had absolute worst internal site for accessing HR documents and accessing personal resources. Just a maze of links. You could only access it via Internet Explorer (I swear I'm not joking). Everything took forever to load. It was like stepping back into 1997.
- When I gave my 2 week notice, they refused and said I 'owed' them at least a month. LOL not sure how they think they can control people like that. I gleefully told them to 'deal with it'. This happened about 45 days after I started as it became obvious very quickly how bad this company treats people.
Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
71–80 of 218 posts
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#72This kind of stories is one of the reason I visit Hacker News. Thank you! It's funny and annoying to read every week or so about another epic fail of a multi-billion "multinational information technology company". Good luck with outsourcing your critical services and medical data to neurodivergents. Thanks again for making my day.
Not outsourcing, its incompetent engineers. Do you know how many american companies got hacked because of 200k enginners istakes?
Still some american banks store user passwords in plain text, Allow sim awapping without a proper check and so
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#73When attempting to look at the git pull request files changed details [1], Github returns a server error.
Any ideas why?
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#74Their entire cybersecurity page is just a bunch of gibberish. It's like someone slapped together buzzwords and phrases until they filled a word count.
They could always segment networks to satisfy modern goals :)
And puppy mills explain the aptitude with some company cultures :p
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#75Interesting that pull requests 1 and 2 on that repo cause a 500 error when I try to view their diffs. Is this due to action on github's part to try to suppress displaying of the keys?
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#76This kind of stories is one of the reason I visit Hacker News. Thank you! It's funny and annoying to read every week or so about another epic fail of a multi-billion "multinational information technology company". Good luck with outsourcing your critical services and medical data to neurodivergents. Thanks again for making my day.
Not outsourcing, its incompetent engineers. Do you know how many american companies got hacked because of 200k enginners istakes? Still some american banks store user passwords in plain text, Allow sim awapping without a proper check and so
Yep, I guess you are right. But I think that some of those engineers come from Infosys-like companies, so they do exactly what they’ve been taught and what they are accustomed with. IDK, maybe it’s a cultural problem? Or is it a problem of following best security practices?
I understand that it’s useless to seek answers to such questions. Let’s leave it to philosophers. :)
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#77> Johns_Hopkins_Hospital/Input/Excel/Covid_patientdetails/covid_patient_details.xlsx
Should I file the HIPAA complaint, or has someone else already done that?
(the stupid government website for filing complaints is, of course, not loading for me now)
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#78Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved…
The lesson here is that there are things worse than downtime. Yeah the site being down is bad but hey, what's worse? Leaking PII all over the place.
Even worse: PHI.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#79When do companies finally start adopting the `security.txt` proposal (see https://securitytxt.org ). Would have made a big difference! EDIT: That GitHub user is gone for good.
I'd really like to see a bugs.txt as well. The amount of large sites I have repeatable bugs on with no way to report the is frustrating.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#80Is it possible to do a full sweep across all tokens in all Python files (for instance) in Github and find such keys? Can you tell from the contents if it's a key or some such "important" string?
The keys here were actually in the published package, not in GitHub, as it seems it was published by accident.
Here[1] are the prefixes used for all AWS IAM access keys. Here[2] is the API definition for an access key. If you're going to search all of PyPy for keys, here's some more keys you can look for: [3] [4]
[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_i... [2] https://docs.aws.amazon.com/IAM/latest/APIReference/API_Acce... [3] https://github.com/Josue87/GiveMeSecrets/blob/master/rules.p... [4] https://github.com/BitTheByte/Eagle/blob/master/plugins/spid...