Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
1–10 of 218 posts
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#2Their entire cybersecurity page is just a bunch of gibberish. It's like someone slapped together buzzwords and phrases until they filled a word count.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#3I really wish this surprised me. The number of people who completely understand the stack they are working on is shrinking, even as the size of the stack grows.
The power of computing is such that every organization on the planet is forced to lower the bar to get people who are marginally competent, even if they lack attention detail and cannot be relied on to solve problems of this sort. This kind of leak is the result.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#4When do companies finally start adopting the `security.txt` proposal (see https://securitytxt.org). Would have made a big difference!
EDIT: That GitHub user is gone for good.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#5Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production.
But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved someone some pain: not the negligent development team, but a real patient and human being, perhaps many of them.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#6[deleted]
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#7No post body was provided.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#8Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved…
The lesson here is that there are things worse than downtime. Yeah the site being down is bad but hey, what's worse? Leaking PII all over the place.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#9> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless:
Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've witnessed). Wouldn't be surprised if this turns out to be just the tip of the iceberg, because putting people with 6-12 months of programming / computer "experience" (that they only signed up for because of the money) in charge of major production systems is a recipe for disaster.
Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year
#10Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved…
Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.