Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

151–160 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#151

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

The first "hack" I ever reported was when I found a plaintext passwords file on my high school computer network...in 1987. The more things change, the more they stay the same.

Machine Head - Struck A Nerve

The more things change, the more they stay the same.

Wise words, lovely song.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#152
post #124

Earlier quoted context omitted.

You mean like if our government was compromised at the highest levels and they wanted to undermine everything without the public realizing? Btw what happened to all the social security data that DOGE exfiltrated?

the fact we're asking about it means the public realized the problem is the public is dumb, at least when it comes to security, and couldn't tell you why password123 is bad

I think most people realize that leaving your passwords in public is dangerous.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#153
post #124
post #67

Earlier quoted context omitted.

Sometimes I feel like it's a cover for some other org actually just wanting to steal the data and this being the excuse.

You mean like if our government was compromised at the highest levels and they wanted to undermine everything without the public realizing? Btw what happened to all the social security data that DOGE exfiltrated?

When empires collapse, it's usually not caused by a foreign power, but by negligence and corruption from within

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#154

Earlier quoted context omitted.

They replaced the people who put the signs up with people who think signs are too woke.

[flagged]

We can know, and we do know.

https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...

> Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.

https://www.nytimes.com/2025/04/05/us/politics/trump-loomer-...

> For four years, [Trump] nurtured deep resentments about CISA, which had declared that the 2020 election was one of the best run in history, undercutting his false claims that he had been cheated of victory. Weeks after taking office this year, he began a campaign of dismantlement.

> Federal programs that monitored foreign influence and disinformation have been eliminated. Key elements of the warning systems intended to flag possible intrusions into voting software have also been degraded; the effects may not be known until the next major election. And contractors who worked with local election officials to perform cybersecurity testing, usually with federal funding, have found the deals canceled.

> In early March, CISA — which is nested inside the Department of Homeland Security — cut more than $10 million in funding to two critical cybersecurity intelligence-sharing programs that helped detect and deter cyberattacks and that alerted state and local governments about them. One program was dedicated to election security, and the other to broader government assets, including electrical grids.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#155

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

The first "hack" I ever reported was when I found a plaintext passwords file on my high school computer network...in 1987. The more things change, the more they stay the same.

Mine too, but it was in the late 90’s and I found an open table in an access database that the school district used for grades and attendance. It listed plaintext usernames and passwords for every user in the system. I managed to use that to get to know the districts head of IT and get a summer job with them.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#156

Earlier quoted context omitted.

They fired the people who might've prevented that. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.

Not posting secrets to public GitHub repos doesn't need red teaming.

At my job the commits wouldn’t have even made it to our private GitHub repo. The scanners would’ve rejected it when you tried to push a commit.

They find keys and tokens all the time.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#157

Earlier quoted context omitted.

DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional.

[flagged]

You incorrectly mistake "no authority" for "didn't happen". Judges spank the executive branch for exceeding their authority fairly regularly, including in this case.

https://lawandcrime.com/high-profile/no-statutory-authority-...

> The court finds that neither OPM nor OMB have any statutory authority to terminate employees – aside from their own internal employees – "or to order other agencies to downsize" or to restructure other agencies. And, as far as the Elon Musk-led agency is concerned, the judge is withering: "As plaintiffs rightly note, DOGE 'has no statutory authority at all.'"

https://www.reuters.com/world/us/trump-scores-win-suit-chall...

> A judge on Tuesday declined to immediately block Elon Musk's government efficiency department from directing firings of federal workers or accessing databases, but said the case raises questions about Musk's apparent unchecked authority as a top deputy to President Donald Trump.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#158

Earlier quoted context omitted.

This was yesterday. It's an early stage project and I would have never created a .env file on my own, but I had let Claude get pretty far along on the PLAN.md before I decided to clean up a bit. Nothing lost for me here, fortunately, but it's definitely a big foot gun that I've never seen mentioned in any of the Vibe Coding or LLM Agent Coding training courses that the security team has forced me to do.

That's interesting to me, because Claude never creates the .env files for me. It will create the .env.example with defaults in it. When I ask it to create the .env, it will reply with the bash to use to copy the .example file, but it wont execute it for me, even when requested.

It read the .env file after I created it from the example, spreading its contents into many places.

Unfortunately, the .env anti-pattern is endemic throughout many projects, and whether Claude creates the .env from scratch or merely the .env.example, it will end up feeding the .env back to Anthropic with enough interaction, apparently. And developers should expect all files in their work directory to be read by Claude, that's not so much a fault of Claude as it is with the .env anti-pattern.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#159

Earlier quoted context omitted.

OpenAI and Anthropic are open about using user data to train on, it's not me "figuring" anything. Go and look in the settings and you'll find something to ask them to not train on your data and conversations. > I mean, I can also make up a training process that makes me right? Seems kind of obvious that they are paraphrasing data. I'm not fully following what you're saying here. But if you're thinking they paraphrase…

the discourse on hacker news has gotten very bad. why are we having this stupid conversation, where you say it would be weird for the people who you are mad about to do the obvious thing to solve the problem you are mad about? i agree that they don't have evidence of how the training data is prepared, but that's a separate issue from, are they going to make obvious mistakes? the LLMs have never hallucinated a key tha…

> the discourse on hacker news has gotten very bad. why are we having this stupid conversation

On this we are agreed. But I can't parse any meaning out of the rest of your paragraph.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#160

Earlier quoted context omitted.

Reading that article makes it look like Trump/Noem filled positions with foreign moles. One day the American people will have an accounting.

After reading Madhu's Wikipedia page and some basic research it looks like he failed his polygraph required to access controlled compartmentalized information (SCI), then DHS (under Noem) then fired six career staffers because of him failing his polygraph. He also does not appear to meet the US Persons requirement for TS:SCI clearance. That's somehow more bananas to me than so many other things the Trump admin has do…

[deleted]
Post reply on HN