Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#111

Post by forgotaccount3 »

cozzyd wrote: post #56
epistasis wrote: post #41

Earlier quoted context omitted.

I don't think anybody actively trusts a hosted LLM with secrets. The problem is that they don't realize they have granted trust to the LLM.

People happily run AI Desktop agents or whatever on their main user acounts commingled with ssh keys and who knows how many tokens.

Sure, some do.

But also... I use Kiro. I open a terminal into a folder where my repo is. I run kiro-cli. I don't know if it has access to the credentials file in my .aws directory. I know it prompts me for approval to use tools but that is a harness thing, does the mac itself prevent it from accessing the credential file?

I use AI because it's useful and I follow the practices dictated by our AI adoption team but I don't know the nuance of everything about it and that makes it difficult to know when some case which is not explicitly covered by training might leak important information.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#112

Post by Forgeties79 »

sandeepkd wrote: post #57
binkHN wrote: post #50

Earlier quoted context omitted.

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than somethin…

> While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security.

This isn’t a grocery store or something it’s CISA. This is like a gun going off in a cop’s holster while he’s texting and driving without a seatbelt. Yeah he’s a contractor but that doesn’t suddenly allow for such incompetence.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#113

Post by epistasis »

doctorpangloss wrote: post #105
epistasis wrote: post #104

Earlier quoted context omitted.

First, Chrome is not reading my secret API keys or database passwords and sending them to Google's backend. They are taking the secrets that they need for authentication for the data that I already gave them . Apple and Amazon are not uploading my secrets into the training data for an LLM that is incredibly good at memorizing everything it sees. The only reason Google isn't doing that is I'm not using their LLMs at t…

Why do you figure they are training on your secrets, even if they "have" them? For some definition of "have." That only you have. I mean, I can also make up a training process that makes me right? Seems kind of obvious that they are paraphrasing data.

OpenAI and Anthropic are open about using user data to train on, it's not me "figuring" anything.

Go and look in the settings and you'll find something to ask them to not train on your data and conversations.

> I mean, I can also make up a training process that makes me right? Seems kind of obvious that they are paraphrasing data.

I'm not fully following what you're saying here. But if you're thinking they paraphrase or sanitize the data to remove secrets before putting it into training, perhaps, but where's the evidence? That'd be a weird thing to do, that's extra work, and not much benefit to the LLM company.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#114

Post by dude187 »

throwaway5752 wrote: post #42
john_strinlai wrote: post #9

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional.

Yes, DOGE invented storing lists of text passwords and uploading them somewhere. What a monumental cost savings innovation, surely never been done before!

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#115

Post by ImPostingOnHN »

SV_BubbleTime wrote: post #94
totetsu wrote: post #26

Earlier quoted context omitted.

One the one hand the CISA is being gutted, and on the other hand there is an ever increase of rhetoric about cybersecurity, national interests, critical infrastructure..

[flagged]

Complaining about gross negligence, after all the competence has been gutted out, strikes me as misdirected frustration.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#116

Post by [deleted] »

dude187 wrote: post #114
throwaway5752 wrote: post #42

Earlier quoted context omitted.

DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional.

Yes, DOGE invented storing lists of text passwords and uploading them somewhere. What a monumental cost savings innovation, surely never been done before!

[deleted]

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#117

Post by protastus »

In 2026, storing government credentials in a repo and not having scanners to flag it should be investigated. I am highly suspicious of anyone doing this in a professional capacity. If I worked at a foreign intelligence agency and saw this, I would first think it's a honeypot, and an unimaginative one because it's so lacking in subtlety.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#118

Post by epistasis »

forgotaccount3 wrote: post #111
cozzyd wrote: post #56

Earlier quoted context omitted.

People happily run AI Desktop agents or whatever on their main user acounts commingled with ssh keys and who knows how many tokens.

Sure, some do. But also... I use Kiro. I open a terminal into a folder where my repo is. I run kiro-cli. I don't know if it has access to the credentials file in my .aws directory. I know it prompts me for approval to use tools but that is a harness thing, does the mac itself prevent it from accessing the credential file? I use AI because it's useful and I follow the practices dictated by our AI adoption team but I d…

One advantage of AWS is short-lived credentials (hopefully, as long as it's configured correctly!)

So go ahead and dump your AWS SSO tokens to the LLM by accident, but it's going to take longer than a day to train a new model and ship it out to the world.

Also, I think kiro only uses AWS Bedrock, IIRC, so no training data goes back to the LLM manufacturers? At least I would hope so.

Database passwords, API keys to services with arduous rotation procedures, that's where the real exploits will come from in coming months, I think.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#119

Post by tristor »

doodlebugging wrote: post #58
debarshri wrote: post #5

They also uploaded sensitive docs in chatgpt [1] [1] https://www.politico.com/news/2026/01/27/cisa-madhu-gottumuk...

Reading that article makes it look like Trump/Noem filled positions with foreign moles. One day the American people will have an accounting.

After reading Madhu's Wikipedia page and some basic research it looks like he failed his polygraph required to access controlled compartmentalized information (SCI), then DHS (under Noem) then fired six career staffers because of him failing his polygraph. He also does not appear to meet the US Persons requirement for TS:SCI clearance.

That's somehow more bananas to me than so many other things the Trump admin has done, simply because they managed to break the Iron Law of Bureaucracy, but of course only in ways which further damage the country through corruption and incompetence.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#120

Post by jnovek »

parineum wrote: post #71
ceejayoz wrote: post #69

Earlier quoted context omitted.

They fired the people who might've prevented that. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.

Not posting secrets to public GitHub repos doesn't need red teaming.

Storing a bunch of passwords in a plain-text list that an individual can access violates zero-trust AND least-privilege which I think a red team might have some opinions on.
Post reply on HN