Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#121

Post by bflesch »

chrismarlow9 wrote: post #102

Sounds about right. Security is a joke everywhere right now. First to market is all that matters anymore and security is the very first thing to be thrown out when it stands in the way.

Can we blame people who realize that everything is tracked and backdoored anyways, and 99% of threat actors are basically untouchable?

Both my own aristocrat/intelligence class and the opposing bloc are fleecing us at the same time. Why even bother if you are not in the club but seen as an extractable resource?

At this point the counterparty is a combination of intelligence/mafia/aristocracy, with diplomatic immunity and license to kill.

(it's tongue in cheek, I actually do bother about this topic)

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#122

Post by Hikikomori »

sandeepkd wrote: post #88
mikestew wrote: post #73

Earlier quoted context omitted.

The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. This strikes me as so wrong, I wonder if I’m misreading your comment. For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of pass…

Lets take a concrete example, suppose you have AWS root account credentials. Are you going to assign them to one individual identity or as a company you would keep them accessible to a group of admins. Its going to be the second choice almost for every big company which makes them shared credentials. Coming to team password managers at high level, its a shared location guarded behind closed doors (probably encryption…

We deleted the root credentials efter initial setup where we added mgmt iam accounts used by our automation. If we ever needed them we used the recovery process. All users and services use temporary credentials.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#123

Post by bix6 »

protastus wrote: post #117

In 2026, storing government credentials in a repo and not having scanners to flag it should be investigated. I am highly suspicious of anyone doing this in a professional capacity. If I worked at a foreign intelligence agency and saw this, I would first think it's a honeypot, and an unimaginative one because it's so lacking in subtlety.

Good thing we fired every competent person in government!

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#124

Post by bix6 »

gleenn wrote: post #67
tantalor wrote: post #15

Earlier quoted context omitted.

The word you're looking for is "gross negligence"

Sometimes I feel like it's a cover for some other org actually just wanting to steal the data and this being the excuse.

You mean like if our government was compromised at the highest levels and they wanted to undermine everything without the public realizing? Btw what happened to all the social security data that DOGE exfiltrated?

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#126

Post by jermaustin1 »

epistasis wrote: post #107
doctoboggan wrote: post #92

Earlier quoted context omitted.

When did this happen? I think I only started noticing around a month ago that Claude had some new system prompts or some other mechanism that heavily encouraged it to not read secrets. Around the same time I also noticed that if it did read any secrets they were ****'d out in the logs.

This was yesterday. It's an early stage project and I would have never created a .env file on my own, but I had let Claude get pretty far along on the PLAN.md before I decided to clean up a bit. Nothing lost for me here, fortunately, but it's definitely a big foot gun that I've never seen mentioned in any of the Vibe Coding or LLM Agent Coding training courses that the security team has forced me to do.

That's interesting to me, because Claude never creates the .env files for me. It will create the .env.example with defaults in it. When I ask it to create the .env, it will reply with the bash to use to copy the .example file, but it wont execute it for me, even when requested.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#127

Post by sandeepkd »

Hikikomori wrote: post #122
sandeepkd wrote: post #88

Earlier quoted context omitted.

Lets take a concrete example, suppose you have AWS root account credentials. Are you going to assign them to one individual identity or as a company you would keep them accessible to a group of admins. Its going to be the second choice almost for every big company which makes them shared credentials. Coming to team password managers at high level, its a shared location guarded behind closed doors (probably encryption…

We deleted the root credentials efter initial setup where we added mgmt iam accounts used by our automation. If we ever needed them we used the recovery process. All users and services use temporary credentials.

This would be a incorrect representation/comparison of the problem being discussed. The semantics of ROOT account changes in the case when a separate management IAM account is introduced. In this case the question would become how you are securing the ROOT credentials for the separate AWS IAM management account/tenant.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#128

Post by Hikikomori »

sandeepkd wrote: post #127
Hikikomori wrote: post #122

Earlier quoted context omitted.

We deleted the root credentials efter initial setup where we added mgmt iam accounts used by our automation. If we ever needed them we used the recovery process. All users and services use temporary credentials.

This would be a incorrect representation/comparison of the problem being discussed. The semantics of ROOT account changes in the case when a separate management IAM account is introduced. In this case the question would become how you are securing the ROOT credentials for the separate AWS IAM management account/tenant.

What part of we store no root credentials is confusing?

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#130

Post by doctorpangloss »

epistasis wrote: post #113
doctorpangloss wrote: post #105

Earlier quoted context omitted.

Why do you figure they are training on your secrets, even if they "have" them? For some definition of "have." That only you have. I mean, I can also make up a training process that makes me right? Seems kind of obvious that they are paraphrasing data.

OpenAI and Anthropic are open about using user data to train on, it's not me "figuring" anything. Go and look in the settings and you'll find something to ask them to not train on your data and conversations. > I mean, I can also make up a training process that makes me right? Seems kind of obvious that they are paraphrasing data. I'm not fully following what you're saying here. But if you're thinking they paraphrase…

the discourse on hacker news has gotten very bad. why are we having this stupid conversation, where you say it would be weird for the people who you are mad about to do the obvious thing to solve the problem you are mad about? i agree that they don't have evidence of how the training data is prepared, but that's a separate issue from, are they going to make obvious mistakes? the LLMs have never hallucinated a key that came from a conversation... there's no evidence that the threat you are describing ever has or ever will occur, other than you can imagine that it could happen, and look, I am also imagining that these people are not stupid and paraphrase the data, so is it just a battle of imaginations?
Post reply on HN