Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

181–190 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#181

Post by pabs3 »

greysteil wrote: post #56
Natsukvshii wrote: post #41

Earlier quoted context omitted.

I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

Would blocking commits containing such tokens/keys be a better option?

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#182

Post by JoeMattiello »

danielodievich wrote: post #8

Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I tho…

I worked for a big startup last year and was on a contract deadline for integrating a vendor framework into a React Native app.

It was taking too long to get a new temp demo license key and GitHub search with clever filters helped me track down a demo key that was recently uploaded to a test repo.

This is also why I use git-secrets in my repos.

https://github.com/awslabs/git-secrets

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#183

Post by JoeMattiello »

pabs3 wrote: post #181
greysteil wrote: post #56

Earlier quoted context omitted.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

Would blocking commits containing such tokens/keys be a better option?

https://github.com/awslabs/git-secrets

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#184

Post by JoeMattiello »

fiddlerwoaroof wrote: post #103
greysteil wrote: post #56

Earlier quoted context omitted.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

I wish I could set this up to block pushes proactively instead of reacting to pushed secrets.

https://github.com/awslabs/git-secrets

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#185

Post by hnlmorg »

pabs3 wrote: post #181
greysteil wrote: post #56

Earlier quoted context omitted.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

Would blocking commits containing such tokens/keys be a better option?

You cannot block what someone commits (they can block it themselves with tools like gitleaks invoked on a pre-commit hook) so the only thing you can do as a 3rd party is to scan and react when you do notice a secret published.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#186

Post by mypalmike »

scarface74 wrote: post #157
insane_dreamer wrote: post #132

Earlier quoted context omitted.

Awesome feature. Saved the day for us some months back when an AWS token was accidentally committed and pushed. (AWS itself also immediately notified us.)

Rant time: this isn’t directed at you. I am just replying to your comment because you said something that triggered me. Also the “you” below is the generic you - not you personally. Disclaimer: I work at AWS in Professional Services, all rants are my own. Now with that out of the way, I hate the fact that there are way too many code samples floating around on the internet that have you explicitly put your access key…

Yeah I just learned the role-based access approach last year. No keys ever hit the box so there's nothing for attackers to exfiltrate.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#187

Post by cwinq »

pabs3 wrote: post #181
greysteil wrote: post #56

Earlier quoted context omitted.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

Would blocking commits containing such tokens/keys be a better option?

You can definitely use pre commit hooks for this like the one of ggshield https://github.com/GitGuardian/ggshield - remediation is far quicker when the secret does't make it to the codebase!

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#188

Post by cwinq »

fiddlerwoaroof wrote: post #103
greysteil wrote: post #56

Earlier quoted context omitted.

GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...

I wish I could set this up to block pushes proactively instead of reacting to pushed secrets.

you can try ggshield - https://github.com/GitGuardian/ggshield -

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#189

Post by mypalmike »

fiddlerwoaroof wrote: post #133
kadoban wrote: post #115

Earlier quoted context omitted.

You could set up something like https://github.com/godaddy/tartufo in a pre-commit hook. Not sure if github has a way to hook into the push hooks on server side, they might though.

Yeah, the issue with pre-commit hooks is you have to remember to set them up client-side. I tend to push to GitHub through a gitolite mirror, though, so I could probably put this in the hooks in my gitolite middlebox.

What do you have to set up client side? They can be committed with the project. Or do I misunderstand?

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#190

Post by cwinq »

dinvlad wrote: post #26
jrockway wrote: post #20

> Git is an awesome version control system, used by over 93% of developers, and is at the heart of modern CI/CD pipelines. One of the benefits of Git is that everyone has a complete copy of the project they are working on. I feel like this is copy-pasted from a pitch deck on why GitGuardian should be funded. Does anyone reading the article care about this anecdote? Like do people stop reading at "well I'm one of the…

This is definitely a marketing piece. And they charge a LOT for it, so it's not a solution for the common masses.

Well, GitGuardian is free for individual developers (20 K of them use it - n°1 app on GitHub market place) and for team below 25. So I guess the masses can enjoy secrets free code! https://github.com/marketplace/gitguardian
Post reply on HN