Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

101–110 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#101

Post by gw99 »

ethbr0 wrote: post #96
gw99 wrote: post #23

Earlier quoted context omitted.

This shit happens all the time. Old school one when I was a security consultant for a bit (pre-automated pentest scammers). Medium size regulated fintech. Domain admin passwords and admin accounts were stuck on post it notes on a board in the machine room. If you went over the road to the college, asked to use the toilet, which they seemed fine with, and poked your 200mm lens out of the bathroom window you could snap…

Everyone complains about post-it notes, but the physical proximity requirement to read them isn't nothing. E.g. compared to network-accessible files. At least, until you have a network-attached webcam pointed at your whiteboard. But the solution to the webcam problem is to write its access credentials on your whiteboard, thus forming a circular and perfectly secure loop.

Just stick an Amazon t shirt on, a reflective yellow waistcoat and a box and you can walk into most SMEs without anyone blinking an eye.

I've seen it done hundreds of times...

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#102

Post by tough »

greysteil wrote: post #56
Natsukvshii wrote: post #41

Earlier quoted context omitted.

I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

Is this really expensive? We're a small startup providing API keys, to our customers.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#103

Post by fiddlerwoaroof »

greysteil wrote: post #56
Natsukvshii wrote: post #41

Earlier quoted context omitted.

I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

I wish I could set this up to block pushes proactively instead of reacting to pushed secrets.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#104

Post by fny »

Is there any reason why keys don't constantly update? It seems like a service could exist where every five minutes a rotation occurs across services with decaying privileges. For example, the 5 minute old key still works, but the 10 minute woman has completely expired.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#106

Post by crazygringo »

fny wrote: post #104

Is there any reason why keys don't constantly update? It seems like a service could exist where every five minutes a rotation occurs across services with decaying privileges. For example, the 5 minute old key still works, but the 10 minute woman has completely expired.

How would you update the keys every 5 min?

Either you'd use an encryption algorithm that depended on a "deeper" key... or you'd fetch the new key while authenticated with, you guessed it, another "deeper" key.

It's keys all the way down. Every key you use, it's your responsibility to keep it private.

(Unless you want to be dealing with physical hardware dongles that generate keys, but those aren't exactly easily portable.)

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#108

Post by beyang »

In case it's helpful, here's a bookmarklet that instantly searches any public repository for the most common secret patterns: https://about.sourcegraph.com/blog/no-more-secrets. Sourcegraph built a feature called "code monitors" that basically runs a recurring search in the background to guard against anti-patterns like API keys and secrets being committed into the codebase.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#109

Post by greysteil »

tough wrote: post #102
greysteil wrote: post #56

Earlier quoted context omitted.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

Is this really expensive? We're a small startup providing API keys, to our customers.

It's totally free - there are details of how to join the program at https://docs.github.com/en/developers/overview/secret-scanni...

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#110

Post by [deleted] »

fny wrote: post #104

Is there any reason why keys don't constantly update? It seems like a service could exist where every five minutes a rotation occurs across services with decaying privileges. For example, the 5 minute old key still works, but the 10 minute woman has completely expired.

[deleted]
Post reply on HN