Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

71–80 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#71

Post by danenania »

JauntyHatAngle wrote: post #32
wereHamster wrote: post #19

Earlier quoted context omitted.

> Production keys in source control IaC, right? If you don't put keys into the Code you can't have Infrastructure as Code. Without keys the code only partially defines your infrastructure.

Huh? No, you use an external secrets manager or leave it to run time environment vars, or leave it to your cd servers to access/supply those details. Assuming you have been given the right tooling, there is no reason for it to be in source code.

If anyone out there is using environment variables currently, and is interested a quick path to plugging the leaks in their secrets management, check out EnvKey[1] (disclaimer: I'm the founder).

Because EnvKey integrates tightly with environment variables, no app code changes are needed to switch, so it only takes a minute or two to import/integrate a typical app.

EnvKey is designed to help avoid incidents exactly like the one that just hit Toyota, while staying out of your way and even making your life significantly easier as a developer by simplifying many aspects of config management.

Give it a look if you know you have some room for improvement in this area and are looking for an easy, secure, open source, end-to-end encrypted solution :)

1 - https://envkey.com

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#72

Post by useful »

robswc wrote: post #38

It can actually be comical just how _bad_ things can be at large orgs. Anyone have details, theories, or a book on how such inefficiencies come about? I can't speak to tech-oriented large orgs but I've worked with others and its just... I'm not shocked at all. I've seen public facing API keys in HTML, private SSH keys that do god knows what in plaintext on FTP servers... I just don't understand how they seem to care…

every organization is held back by the slowest adopter. If you advance too quickly compared to your colleges then you will likely leave because everyone else feels like they are trying to pull you back into their crap. Innovation is a depreciating asset. If you don't reward the people who make a quantum leap, they will leave, and all their progress will revert to the mean.

I bet someone made a security key because it was the right thing to do but they didn't have the controls in place to manage it in their build system and give another key to developers/engineers/etc. So someone else copied it for convivence rather than have to explain to every moron in the whole company how to use it to access the database or run their monolith tests or get access from the dude that no longer works there who was the "giver" of access keys.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#74

Post by matai_kolila »

gw99 wrote: post #27
matai_kolila wrote: post #14

Earlier quoted context omitted.

> Note: the invite input box actually autocompletes ALL github usernames. I'm sorry, but that's wild. That's like, not even an easy engineering problem to solve necessarily, given their size!

Not really. They only have 83-90 million users. That's not really a big table, at least in my world...

In my world 20 is a lot because finding customers is hard... :(

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#75

Post by paxys »

danielodievich wrote: post #8

Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I tho…

Github supports this out of the box – https://docs.github.com/en/code-security/secret-scanning/abo..., and recognizes tokens from a lot of services.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#76

Post by prepend »

ccakes wrote: post #36
gw99 wrote: post #9

Earlier quoted context omitted.

Oh yes this. It's so easy to critically fuck up an invite into an organisation. If you get typo the username you are potentially compromised. I've seen a couple of near misses on this already. Note: the invite input box actually autocompletes ALL github usernames.

You can invite by email addr, so the workaround here is only invite corporate email addresses. If the target user hasn't added their corp email to their profile then they can't be part of the org.

This is what I do but I really wish there was a better integration with auth providers and could use it for the invite. Would be nice to search my directory to type the email and confirm the name matches the email.

This is what GitLab does with their hosted AD/LDAP connector.

I’m in fear of mistyping something and inviting the wrong person.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#77

Post by bonestamp2 »

tomschwiha wrote: post #53
bonestamp2 wrote: post #25

Earlier quoted context omitted.

I committed my google maps api key to a public github repository recently and github immediately sent me a warning about it. The thing is, I did it intentionally. The key is used on my website and the website is served by github pages. Now, it's an embedded maps api key, there's no cost to use it, nobody can use it from a domain other than mine, and it's easily visible in the page source if someone views that, so the…

I just wondered what happens if you spoof locally the domain name. Could you still use the api key?

Maybe. Thankfully there's no cost to use the key if someone does it.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#78

Post by lumberjack24 »

eax-eip wrote: post #45

Most of these (even sometimes expensive) tools only look at repos and users who are associated with the company’s GitHub org, which barely solves the problem. The much harder problem is the number of corporate secrets that are on random repositories (personal dotfiles, automations, data science scripts, etc.) across GitHub with no strong relationship to the organization. Try using GitHub Code Search to find all the F…

GitGuardian actually does this, it monitors an extended perimeter of devs and their personal/open-source repos for corporate secrets or keywords – https://www.gitguardian.com/monitor-public-github-for-secret...

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#79

Post by prepend »

robswc wrote: post #38

It can actually be comical just how _bad_ things can be at large orgs. Anyone have details, theories, or a book on how such inefficiencies come about? I can't speak to tech-oriented large orgs but I've worked with others and its just... I'm not shocked at all. I've seen public facing API keys in HTML, private SSH keys that do god knows what in plaintext on FTP servers... I just don't understand how they seem to care…

There’s a book by John Gall called the Systems Bible [0] that goes into how big systems form and fall apart. Mostly anecdotes and no real solution, but a decent read that isn’t full of the usual BS that’s required because usually only large systems can afford high speaker fees.

[0] https://www.goodreads.com/book/show/583785.The_Systems_Bible

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#80

Post by bpye »

chaps wrote: post #11

Hah. Yeah. Found a bunch of ssh keys, passwords, etc for Comcast years back which turned into a shitshow when I tried to report it. Once I found the right people to talk to things got better, but the entire experience was really reflective of how bad large orgs are with security. A friend once told me he was having a hard time getting a client to take his security concerns seriously. So I went on github and found a c…

I've never had an outright bad experience reporting a security issue, but some companies definitely aren't geared up to handle reports. I found that an energy provider's API would give usage information for past addresses and eventually I think the right team got told, but it was a nightmare trying to find someone to actually report the issue to.
Post reply on HN