Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iViewed your API keys

wale.id.au

Post reply on HN
Print view View original

11–20 of 116 posts

Re: iViewed your API keys

#11

Post by OJFord »

Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

I booked a hotel stay (in Canada, not Australia) and got an error page at some point that dumped out all env vars including database credentials.

Tried my best to report (not publicly disclose) it, including asking the front desk for contact information for IT; no response.

I think we're (on HN) often in quite a bubble of being (or striving to be) hot on this sort of thing, or frankly far trickier to exploit sorts of things, when really the bar for a lot of ('IT is a cost centre') stuff out there is extremely low.

I don't think this sort of leak or vulnerability is anywhere near as rare (which isn't even that rare) as it seems - I think an awful lot must just get quietly exploited or go unnoticed. We're only hearing about this one because someone thought it was 'lolz', I didn't publicize the one I noticed (in my normal user behaviour of just trying to book a room!) nor did I see if I could connect to the database and book myself in for free or something. And I only noticed it because it a) experienced an error; b) dumped env vars in the event of an error - i.e. I didn't have to look for it. How many other sites have I used since with similar problems but which just didn't happen to serve it up on a silver platter for me?

Re: iViewed your API keys

#12

Post by ascar »

reuben364 wrote: post #8
derekbaker783 wrote: post #5

Earlier quoted context omitted.

The same applies in the US, unfortunately.

See: this ad from Gov Parson in response to a disclosure about a state website leaking social security numbers of teachers https://m.youtube.com/watch?v=9IBPeRa7U8E

"the hacker[/journalist] decoded the HTML source code" and must be prosecuted.

I can't believe what I just watched.

Re: iViewed your API keys

#13

Post by nomilk »

Oberbaumbrucke wrote: post #7
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Completely agree. The AU Gov would probably call this hacking

The "ctrl + alt + u" attack vector.

Re: iViewed your API keys

#15

Post by dhimes »

reuben364 wrote: post #8
derekbaker783 wrote: post #5

Earlier quoted context omitted.

The same applies in the US, unfortunately.

See: this ad from Gov Parson in response to a disclosure about a state website leaking social security numbers of teachers https://m.youtube.com/watch?v=9IBPeRa7U8E

For others: The ad claims that the news outlet that published the fact that the state website had teacher SSNs was part of the "fake news media" exploiting privacy for political gains.

Apparently the SSNs were embedded in the pages html. The ad makes it sound like a huge reverse-engineering job.

Re: iViewed your API keys

#16

Post by maccard »

raxxorraxor wrote: post #6

To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programm…

> How do you provide your secrets to your apps? Using an external service? That would still require another set of credentials. Using environment variables? A file only the user running the app has access too? Another way?

It sucks for a small team or for anyone who is trying to run a free tier, but terraform plus aws secrets manager or vault works really well. Using a db password as an example, for our app we generate a random password, store it in secrets manager, and our containers on fargate run with an iam role that allows access to that secret. Our state is stored in S3, and the infra is applied on commit to main with a terraform plan run on the merge request to main.

Our biggest security vector is always going to be someone using elevated credentials to access something, but this way there is no state on a developers machine at any point for any of our production infra.

Re: iViewed your API keys

#17

Post by Grimburger »

spellsaidwrong wrote: post #9
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Thankfully, I already disclosed the issue to iView's engineer team back in December 2021, and a lot of the original data has since been removed from the site. I do try to take care of this issue by censoring a lot of information about the security issue in the write-up, but I'm not sure if that is enough.

I certainly understand, hopefully you see my point though that being right sadly isn't enough for many/most in our country anymore :/

Good luck with things, it was just a warning and hopefully not a dissuasion from continuing on.

https://www.theguardian.com/australia-news/2020/mar/08/melbo...

Re: iViewed your API keys

#18

Post by omegalulw »

raxxorraxor wrote: post #6

To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programm…

> How do you provide your secrets to your apps? Using an external service? That would still require another set of credentials. Using environment variables? A file only the user running the app has access too? Another way?

A credential/key storage service, either on device/server or as a separate device, with IAM to control whether the user executing that process can use that secret or not. The user in this case for prod services should be a prod (non-human) user.

When all your services are like this, no person should have direct access. You generate key/secrets depending which services you want to allow to communicate with each other and the keys live in the key store. For secrets for external services, e.g. API keys, someone would have to enter them once, yes.

You also should try not to rely on secrets, rather invest in proper authentication/authorization logic.

Re: iViewed your API keys

#19

Post by mimentum »

Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Na you'd be alright -we're not authoritarian here

Re: iViewed your API keys

#20

Post by greggsy »

Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

They’ve been reasonable by waiting four months from initial contact, but in vulnerability disclosures it’s polite to add a better timeline of events. There’s still some detail that hasn’t been fully resolved, but it’s not clear what the residual impact is.

This particular post doesn’t really seem to go into too much depth about what these keys are used for, or the damage that could be done, but I’m erring on the side of ‘meh’ until proven otherwise. It’s freely viewable content if you’re in Australia. They’ve obviously stuffed up on multiple fronts, and my money is on these issues being introduced by an integrator, rather than ABC employee.

Lastly, the ABC is a corporate entity that is fully owned by the commonwealth (and beloved by most Australians) - tue article describes it as ‘state media’, which has sinister propaganda connotations of broadcasters in some other countries.

Post reply on HN