Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iViewed your API keys

wale.id.au

Post reply on HN
Print view View original

21–30 of 116 posts

Re: iViewed your API keys

#21

Post by mimentum »

spellsaidwrong wrote: post #9
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Thankfully, I already disclosed the issue to iView's engineer team back in December 2021, and a lot of the original data has since been removed from the site. I do try to take care of this issue by censoring a lot of information about the security issue in the write-up, but I'm not sure if that is enough.

It has been censored enough, given the timeframe and previous disclosure to ABC. Good article though.

Re: iViewed your API keys

#22

Post by greggsy »

Oberbaumbrucke wrote: post #7
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Completely agree. The AU Gov would probably call this hacking

No, the Australian Cyber Security Centre would consider this responsible disclosure and advise the ABC to uplift their review processes.

On the other hand, Sky News (the current government’s right wing mouthpiece) would use this as an opportunity to discredit the ABC.

Re: iViewed your API keys

#23

Post by femto »

Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

The current Prime Minister would be torn between "law and order" and "sticking it to the ABC". His head would explode.

Re: iViewed your API keys

#25

Post by ratww »

alias_neo wrote: post #10
raxxorraxor wrote: post #6

To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programm…

The step they seem to be missing is _the entire development process_. If you're using API keys to access stuff, you do it on your backend, there's no excuse for that stuff to make it to the frontend. If your "client" needs access to sensitive API keys, you need to rethink your architecture. As a (senior) backend software engineer, this reeks of a person/team who doesn't know how to architect and/or implement web appl…

Is is a bit more nuanced than that. This web client needs access to non-secret keys that are passed via environment variables. This is absolutely commonplace.

However there are two real issues here: first, some bug in the code is causing all environment variables to be dumped into the JS bundle. You can see that in inane keys like PATH, HOME, PORT.

This issue wouldn't be such a huge problem by itself. The second problem is that during the build process for the frontend, there are environment variables that shouldn't be there, such as the secret ones. The CI or build machine should have been well isolated enough to prevent this problem from happening.

This is a problem in the CI coupled with a bad build process.

Re: iViewed your API keys

#26

Post by greggsy »

reuben364 wrote: post #8
derekbaker783 wrote: post #5

Earlier quoted context omitted.

The same applies in the US, unfortunately.

See: this ad from Gov Parson in response to a disclosure about a state website leaking social security numbers of teachers https://m.youtube.com/watch?v=9IBPeRa7U8E

The two situations aren’t really comparable. The ABC, or the minister responsible for selecting it’s CEO (it’s owned and funded by the gov as a corporate entity, but not run by it) would be laughed out of the room if they suggested that the author should be charged.

Re: iViewed your API keys

#27

Post by michaelt »

Oberbaumbrucke wrote: post #7
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Completely agree. The AU Gov would probably call this hacking

Quite a few countries have laws from the 1980s that basically say "gaining unauthorised access to computer systems is a crime"

Which is of course a very expansive definition. Think you've found a leaked database credential and you test it before reporting, so as not to create a false alarm? That's illegal hacking. Almost any persistent XSS? That's illegal hacking. Access an admin panel by entering a default password? You guessed it, illegal hacking.

We might get the impression these laws don't exist, because they aren't enforced internationally or if the hacker can't be identified - so black-hat hacking, cryptolockers, tech support scams, giant data breaches and suchlike go completely unpunished. But a white-hat hacker who identifies themselves in hopes of getting their security report taken seriously might well get a visit from the cops.

Re: iViewed your API keys

#28

Post by zach_garwood »

account-5 wrote: post #4

I'm not a web developer but this stuff, from the outside looking in, is reason enough for me to avoid. Obviously I'm no expert but this sort of stuff happens enough that I wouldn't even know where to start to learn this stuff properly.

The disappointing thing is that preventing this sort of thing doesn't take an expert. If you wouldn't post a secret to Reddit or Twitter, don't send that secret to a browser client. That's like webdev 101 stuff.

Re: iViewed your API keys

#29

Post by Macha »

omegalulw wrote: post #18
raxxorraxor wrote: post #6

To be fair, I think a lot of developers begin with that. There is a logistical problem in providing secrets to a process without getting the secret exposed. Environment variables are an often chosen approach. Of course when the software is tested and ready to be deployed, the step to use a secure container containing credentials is often neglected like it was probably done here. This isn't necessarily sloppy programm…

> How do you provide your secrets to your apps? Using an external service? That would still require another set of credentials. Using environment variables? A file only the user running the app has access too? Another way? A credential/key storage service, either on device/server or as a separate device, with IAM to control whether the user executing that process can use that secret or not. The user in this case for…

There's a chicken and egg problem here. If you move your secrets to a secret management service, how do you provide the credentials to unlock to that? Whether it's on disk, in the environment or on an internal endpoint like IAM host roles there's ways for this to be exposed in the event of bugs or security vulnerabilities in your application
Post reply on HN