Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#71

Post by parineum »

ceejayoz wrote: post #69
parineum wrote: post #64

Earlier quoted context omitted.

Which DOGE employee put this file on GitHub?

They fired the people who might've prevented that. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.

Not posting secrets to public GitHub repos doesn't need red teaming.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#72

Post by parliament32 »

ttul wrote: post #8

Yet another argument for the death of the API key. Replacements abound; let's get on with it.

And passwords. Shared secrets in general are a bad idea. If you're copy/pasting strings around to be used for authentication, you've done something wrong.

Workload identities and passwordless auth are the one true path.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#73

Post by mikestew »

sandeepkd wrote: post #57
binkHN wrote: post #50

Earlier quoted context omitted.

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than somethin…

The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases.

This strikes me as so wrong, I wonder if I’m misreading your comment. For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#74

Post by ceejayoz »

parineum wrote: post #71
ceejayoz wrote: post #69

Earlier quoted context omitted.

They fired the people who might've prevented that. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.

Not posting secrets to public GitHub repos doesn't need red teaming.

A red team might well notice that the build process doesn't check for accidentally committed secrets.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#75

Post by skywhopper »

parineum wrote: post #64
throwaway5752 wrote: post #42

Earlier quoted context omitted.

DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional.

Which DOGE employee put this file on GitHub?

The one who fired the team that prevented this sort of thing.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#76

Post by MrDarcy »

sandeepkd wrote: post #57
binkHN wrote: post #50

Earlier quoted context omitted.

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than somethin…

The error and omission of not enforcing mandatory security training covering posting plaintext passwords to public sites for CISA contractors is itself an act of gross negligence.

So much so the contracting company’s insurer would cite it as the reason why the claim is not covered by their policy.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#77

Post by gumby271 »

parineum wrote: post #71
ceejayoz wrote: post #69

Earlier quoted context omitted.

They fired the people who might've prevented that. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.

Not posting secrets to public GitHub repos doesn't need red teaming.

And yet, here we are.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#78

Post by passive »

Uh, so it says this dates from Nov 2025.

Nov 2025 was also when most of us learned about the acting Chief Security Officer at DHS, whose name AND photo seem exactly like the calling card of someone who had these "keys to the kingdom". https://bsky.app/profile/andylevy.net/post/3m6ivhnthts2o

I want to believe...

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#80

Post by epistasis »

cozzyd wrote: post #56
epistasis wrote: post #41

Earlier quoted context omitted.

I don't think anybody actively trusts a hosted LLM with secrets. The problem is that they don't realize they have granted trust to the LLM.

People happily run AI Desktop agents or whatever on their main user acounts commingled with ssh keys and who knows how many tokens.

This is one reason I haven't had any SSH keys on disk (encrypted or not) ever since I got a YubiKey, and it's only become easier with Secure Enclave on macs since then.

However, dev database passwords for small projects in .env files? API keys to some random LLM service that I put $5 into once 8 months ago and haven't touched since then? All that's open to the LLM.

It's time to clean up our personal disks as if we had an intruder exfiltrating sensitive secrets at all times.

Post reply on HN