Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#41

Post by epistasis »

cozzyd wrote: post #14
epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

it seems crazy to "trust" an LLM with any secrets. Anyone running one as their normal user account with access to all files is playing with fire...

I don't think anybody actively trusts a hosted LLM with secrets. The problem is that they don't realize they have granted trust to the LLM.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#42

Post by throwaway5752 »

john_strinlai wrote: post #9

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them.

It is a bad plan that has and will continue to harm people, but it is intentional.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#43

Post by epistasis »

mooreds wrote: post #27
philipwhiuk wrote: post #6

Earlier quoted context omitted.

Sure but like, no AI was needed here. Regular human stupidity is still pretty potent.

This is the thing that gets me about all the AI security pieces I read. Yes, AI can enable new attack vectors (prompt injection can be repeated N times when a human subject to the same messaging would bail). But what AI really does is shine a spotlight on all the flaws folks like OWASP have been talking about for decades. Secret rotation and short lived credentials don't require AI to implement, nor does their lack r…

Agreed 99%, but there is something a bit novel here, though: massive LLMs are really good at memorizing things, and there's now going to be all sorts of credentials memorized in Claude and ChatGPT, somewhere in the TB of floating point weights, and extracting such credentials and finding where they might be a new source of passwords and API keys to throw onto other huge password leaks. Or not. We'll see!

And in this particular case of CISA secrets, they are definitely stored inside of LLMs for future retrieval, even if no bad actors ever directly downloaded this obscure GitHub repo.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#44

Post by modriano »

stackskipton wrote: post #40
modriano wrote: post #38

Earlier quoted context omitted.

Sure, it could be incompetence. It could also be an intentional strategy to tie up CISA/DHS resources, poison or obstruct CISA/DHS investigations/operations, open up systems to sunlight and journalism, or cause general chaos. The not-responding-when-notified part makes me think it's not just incompetence.

>The not-responding-when-notified part makes me think it's not just incompetence. Strong disagree. The person in question probably thought it was a private repo on Github and had a massive deer in headlights reaction when they got contacted. Whoever this is, lost their job, possibly security clearance and more. This was 100% life altering "mistake"/gross incompetence decision they made.

Maybe. I didn't see enough in the article about the repo owner/committer to make any inference about their intentions and wouldn't jump to conclude it was incompetence or malice or crafty leaking. The only real signal I saw was that the repo didn't immediately turn private when the person was notified.

For some people, yeah, this could be a career killer. For some other people, it might just precipitate a flight back to Moscow or Beijing or something.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#45

Post by XorNot »

jpalawaga wrote: post #18
LelouBil wrote: post #10

Earlier quoted context omitted.

Do you have any examples ? It's the first time I hear about replacing API keys

OAuth with refresh tokens. IAM roles/workload identity. Even time-limited or signed JWT, though has a separate issues. Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.

At that point you've just reinvented Kerberos tickets really...

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#47

Post by dcrazy »

XorNot wrote: post #45
jpalawaga wrote: post #18

Earlier quoted context omitted.

OAuth with refresh tokens. IAM roles/workload identity. Even time-limited or signed JWT, though has a separate issues. Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.

At that point you've just reinvented Kerberos tickets really...

It’s almost like Kerberos was designed and implemented for a reason!

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#48

Post by epistasis »

yieldcrv wrote: post #25
epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

probably but a ton of services have popped up in the last 6 months specifically to help mitigate that localhost reading env from the cloud and other solutions to me it suggested that I’m already late on that idea, but I can understand how that puts me deeper in a bubble than others

I've been using SOPS, which dates back to 2015. It's well tested, robust, supports a ton of great backends. What other solutions have you seen? I'm actively looking around in the space!

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#49

Post by jimt1234 »

john_strinlai wrote: post #9

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

The first "hack" I ever reported was when I found a plaintext passwords file on my high school computer network...in 1987. The more things change, the more they stay the same.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#50

Post by binkHN »

john_strinlai wrote: post #17
tantalor wrote: post #15

Earlier quoted context omitted.

The word you're looking for is "gross negligence"

"crazy crazy" gets the same point across

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.
Post reply on HN