Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

Post reply on HN
Print view View original

131–140 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#131

Post by sandeepkd »

Hikikomori wrote: post #122
sandeepkd wrote: post #88

Earlier quoted context omitted.

Lets take a concrete example, suppose you have AWS root account credentials. Are you going to assign them to one individual identity or as a company you would keep them accessible to a group of admins. Its going to be the second choice almost for every big company which makes them shared credentials. Coming to team password managers at high level, its a shared location guarded behind closed doors (probably encryption…

We deleted the root credentials efter initial setup where we added mgmt iam accounts used by our automation. If we ever needed them we used the recovery process. All users and services use temporary credentials.

I made an assumption that you have federated AWS account setup. One organization management AWS account and then federated accounts under it and you are referring to deletion of deletion of ROOT credentials in the federated accounts.

Considering thats not the case, what you just did is move the goal post to a account recovery process. Question becomes who has ability to recover the account, in case its tied with email then most likely it has to be a shared email box. What you have now is a much more fragile system in case of custom domains, where whoever is controlling the email domain (DNS management capability) can take over the AWS accounts.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#132

Post by morpheuskafka »

The repo name was literally "Private-CISA". Would be fun to (a) search through repo names with private/internal/etc in them and (b) search for govt agency / non-tech company that otherwise wouldn't be expected to appear in repo names. Could probably clone them all and then have an LLM quickly scan for interesting stuff.

Also, doesn't Github have its own automated scanner for something as basic as a AWS credential?

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#133

Post by morpheuskafka »

sandeepkd wrote: post #57
binkHN wrote: post #50

Earlier quoted context omitted.

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than somethin…

He worked for CISA. Surely there is either a security clearance with indoctrination and training, or at the very least, some sort of mandatory training/onboarding for all contractor staff?

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#134

Post by dreamcompiler »

morpheuskafka wrote: post #132

The repo name was literally "Private-CISA". Would be fun to (a) search through repo names with private/internal/etc in them and (b) search for govt agency / non-tech company that otherwise wouldn't be expected to appear in repo names. Could probably clone them all and then have an LLM quickly scan for interesting stuff. Also, doesn't Github have its own automated scanner for something as basic as a AWS credential?

> Also, doesn't Github have its own automated scanner for something as basic as a AWS credential?

If you leave it turned on. TFA says this user had turned it off.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#135

Post by EdwardDiego »

passive wrote: post #78

Uh, so it says this dates from Nov 2025. Nov 2025 was also when most of us learned about the acting Chief Security Officer at DHS, whose name AND photo seem exactly like the calling card of someone who had these "keys to the kingdom". https://bsky.app/profile/andylevy.net/post/3m6ivhnthts2o I want to believe...

I wanna be whoring? Come on, no way that's real.

Also, she looks like she was generated in the character creator from Oblivion.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#136

Post by throwawaypath »

mikestew wrote: post #73
sandeepkd wrote: post #57

Earlier quoted context omitted.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than somethin…

The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. This strikes me as so wrong, I wonder if I’m misreading your comment. For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of pass…

>For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords.

It's CURRENTYEAR. No one should be using team password managers or files to store credentials. There should not be storable credentials.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#137

Post by sandeepkd »

Forgeties79 wrote: post #112
sandeepkd wrote: post #57

Earlier quoted context omitted.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than somethin…

> While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. This isn’t a grocery store or something it’s CISA. This is like a gun going off in a cop’s holster while he’s texting and driving without a seatbelt. Yeah he’s a contractor but that doesn’t suddenly allow for such incompetence.

I have worked with some of the experienced folks in federal space in the past, who were super smart, experienced and COSTLY from managements perspective. They had the ability to challenge the management on such things. Most of them have either retired, managed out or moved on. What you have here is not a reflection of the individual but the entire management chain. Its a race to make most money and at times these contractors are number of seats to fill at lowest possible cost.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#138

Post by Sohcahtoa82 »

theozero wrote: post #52
nrub wrote: post #28

Earlier quoted context omitted.

I no longer keep my dotenv files in plaintext. I use `sops` to keep an encrypted env around and you can use tools like direnv to make them available to your shell while you're working. Obviously the LLM could print any of these secrets, but it's less likely. Additionally I find that at least claude seems to avoid reading the dotenv. And lastly, don't make any local secrets that important. Limited scope, dev accounts,…

You might like varlock - it helps keep secrets out of plaintext by using plugins to pull from various backends (aws ssm, gcp, vault, 1pass, etc). Also has built in local encryption with shared team vaults coming soon. Additionally provides pre commit scanning, log redaction, and much more.

But then you need creds to access AWS SSM, Vault, etc., and those end up getting stored the same way the actual creds you needed were being stored, and you're back at square one.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#139

Post by Sohcahtoa82 »

kittoes wrote: post #65
jallmann wrote: post #61

Earlier quoted context omitted.

> OAuth with refresh tokens. Then the LLM slurps up your refresh token. What's next?

Is that really a concern though in the same way API keys are? Since when do OAuth clients store refresh tokens in areas that LLMs regularly scan? API keys are truly passwords, while refresh tokens are exchanged for a password. Sure, a leak would be bad but I'd argue that it's orders of magnitude less likely compared to the accepted norm.

> Since when do OAuth clients store refresh tokens in areas that LLMs regularly scan?

If you can store your refresh token outside of where LLMs regularly scan, then why not just store your API token in that place?

The point is that refresh tokens do nothing to increase security. If a refresh token can be used to get a token, then the refresh token might as well be the actual token.

It's akin to performing client-side password hashing. It doesn't make your password more secure, it just means your hash is now your password. If someone is able to sniff your traffic, hashing the password first doesn't change anything.

I grow so tired of half-baked security theater.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#140

Post by yabones »

dreamcompiler wrote: post #134
morpheuskafka wrote: post #132

The repo name was literally "Private-CISA". Would be fun to (a) search through repo names with private/internal/etc in them and (b) search for govt agency / non-tech company that otherwise wouldn't be expected to appear in repo names. Could probably clone them all and then have an LLM quickly scan for interesting stuff. Also, doesn't Github have its own automated scanner for something as basic as a AWS credential?

> Also, doesn't Github have its own automated scanner for something as basic as a AWS credential? If you leave it turned on. TFA says this user had turned it off.

I bet the scanner went off quite a few times and the guy disabled it...

"I turned off the carbon monoxide detector because it kept beeping, now I can finally get some sleep"

Post reply on HN