Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

humankode.com

Post reply on HN
Print view View original

91–100 of 110 posts

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#91

Post by hamami »

Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

Exposing an AWS key through a public repo happened to me a few years ago and AWS support called me to confirm whether I was aware of the suspicious activity, when I stated I do not know what's going on they immediately blocked the account and told me I wouldn't be responsible for the cost. Mine was actually much worse, the account was billing a thousand dollars every hour. They told me I'd have to sign up again with a different account.. I'm surprised this process was not followed in author's case.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#92

Post by LeonB »

inopinatus wrote: post #75
Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

I wonder if you actually read the story. The author displays incompetence in technology administration at multiple steps. From committing the basic design error of using hard-coded credentials at all; to committing them to any kind of repository; to failing to check on the visibility of that repository; to giving those credentials privileges they did not need; to failing to act effectively on warning messages. And al…

> all this, apparently, is laid at the feet of Visual Studio

I wonder if you actually read the story.

He admits several faults including most if not all of those you mention.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#94

Post by inopinatus »

LeonB wrote: post #92
inopinatus wrote: post #75

Earlier quoted context omitted.

I wonder if you actually read the story. The author displays incompetence in technology administration at multiple steps. From committing the basic design error of using hard-coded credentials at all; to committing them to any kind of repository; to failing to check on the visibility of that repository; to giving those credentials privileges they did not need; to failing to act effectively on warning messages. And al…

> all this, apparently, is laid at the feet of Visual Studio I wonder if you actually read the story. He admits several faults including most if not all of those you mention.

So what? Admitting fault isn't absolution. He really does go out of his way to blame the tools.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#95

Post by wereHamster »

voltagex_ wrote: post #83
nailer wrote: post #64

Earlier quoted context omitted.

> Encrypt access keys in config files instead of just leaving them exposed in the config file. How do decrypt them when you app re-launches? How do you decrypt them automatically on every instance?

I've moved to using environment variables. I realise they have their own security challenges but at least I'm not accidentally going to git push the keys.

But you probably want to store the descriptions of the instances and what runs on them in a git repository. It doesn't matter whether you use env variables or something else. At some point you will have a git repository which stores the CM for your whole infrastructure.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#96

Post by cwisecarver »

Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

You really want GitHub analyzing your code? REALLY? If the internet found out they were analyzing every push the backlash would be 10x what it is now.

Even if it's public... That's still a Gmail-esque situation that would immediately raise privacy concerns.

Developers should pay attention to what they're doing. Your AWS keys shouldn't even been in your private repo. You should find another way or you shouldn't be using a third-party for source control.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#97

Post by schrodinger »

inopinatus wrote: post #94
LeonB wrote: post #92

Earlier quoted context omitted.

> all this, apparently, is laid at the feet of Visual Studio I wonder if you actually read the story. He admits several faults including most if not all of those you mention.

So what? Admitting fault isn't absolution. He really does go out of his way to blame the tools.

The tool has a huge bug! Even if he wasn't putting credentials in there, it could still have led to sensitive source code getting out or something!

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#98

Post by runamok »

mhuffman wrote: post #39
Alupis wrote: post #24

Earlier quoted context omitted.

Is it really on the web service companies to make sure you (the developer) don't do anything stupid? The article author could have avoided a lot of headache if he simply checked the repo before walking away. Red flags should have gone up as soon as he received the first weird Amazon messages, but he still didn't think to check his own work. The author calls this a "Data Breach" but in reality it was a "Data Leak".

Maybe not, but it think it is the web service company's responsibility to alert and contact you on suspicious activity ... like a sudden $6,000 jump in service usage of spot instances in regions you have never used before. I mean a quick automated email would be enough for you to take action. The way it is set up now, you pay for it and humbly beg Amazon to deduct those charges if they see fit.

You can easily set up billing alerts in cloudwatch to do this. I have done so. I agree by default it should prompt you to do so during the aws on boarding process.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#99

Post by onion2k »

15155 wrote: post #88
onion2k wrote: post #40

Earlier quoted context omitted.

Is it really on the web service companies to make sure you (the developer) don't do anything stupid? Yes. The web service company should look at it as basic security - if people are using their service to discover private information and use it to defraud their users, even if the users have been stupid enough to upload that information publicly, the company should do what they can to mitigate the problem. If I post a…

> mitigate the problem. This seems like very minor engineering effort on behalf of GH - simple regexes, even.

To detect the key, sure. But then there's the interface design to inform the user, hooking in to an email to notify the user if they're committing via git, a system to disable the option if necessary, monitoring the AWS format in case it changes, dealing with other formats that are requested by AWS's competitors, and so on.

I don't think this would be a minor undertaking or simple in any way, but it is important enough that a provider (and target) the size of GitHub should still do it.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#100

Post by x0n »

schrodinger wrote: post #97
inopinatus wrote: post #94

Earlier quoted context omitted.

So what? Admitting fault isn't absolution. He really does go out of his way to blame the tools.

The tool has a huge bug! Even if he wasn't putting credentials in there, it could still have led to sensitive source code getting out or something!

Article updated - VS wasn't the issue. He had installed a 3rd party github extension (from github themselves) that overrides the built-in Git support in visual studio... bug was found, confirmed and fixed yesterday though, so a quick turnaround.
Post reply on HN