31–40 of 68 posts
Earlier quoted context omitted.
Selecting (reading) data is very fast most of the time. So if no token matches I don't think this will result in a DOS.
As spydium suggests in a sibling comment, I was not referring to overwhelming Github infrastructure but to mass invalidation of guessed tokens.
Earlier quoted context omitted.
Selecting (reading) data is very fast most of the time. So if no token matches I don't think this will result in a DOS.
I think they meant it would autoinvalidate the tokens which might be valid. I think the math on an AWS secret and access key would be ridiculous to brute force.. but other types of keys might be an interesting attack vector.
Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
Earlier quoted context omitted.
There are bots (some even run by security and threat intel companies) feeding off of the firehose. For a public display of one type of scanning functionality, take a look at shhgit[0,1]. 0: https://www.shhgit.com/ 1: https://github.com/eth0izzle/shhgit
Is the firehose public or do these companies have a relationship with github? If the latter, I assume github doesn't give the firehose feed to attackers who are only looking for AWS keys.
It is amazing how fast and effective those bots are. I remember one time I installed Windows 95/98. I wanted the PC to be on internet but did not have a firewall for Windows. But I knew the internet address where I could get one. So after installing Windows I took my chances, connected to the internet, downloaded the firewall asap, installed it, and was already too late. The PC was compromised within 10 minutes and I…
Is there a way (outside Github) that adversaries can get access to the "full feed" of commits? I don't understand how the attackers can find a new key from all the changes that must go into github across millions of repos, within 11 minutes.
Docs:
https://developer.github.com/v3/activity/events/#list-public...
https://docs.github.com/en/free-pro-team@latest/rest/referen...
Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
Why secret scanning is enabled only for public repos but not for private ones?
It is amazing how fast and effective those bots are. I remember one time I installed Windows 95/98. I wanted the PC to be on internet but did not have a firewall for Windows. But I knew the internet address where I could get one. So after installing Windows I took my chances, connected to the internet, downloaded the firewall asap, installed it, and was already too late. The PC was compromised within 10 minutes and I…
Where did the malicious code come from?
It was just that there were some holes in Windows that were exploited by bots.
Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
I suppose you could still XOR your secret S with a random bitstring B, then commit both S^B and B. Am I missing something?