4 ms·
Funny. I reported something similar to comcast after finding several of their engineers' home directories on github. Ssh keys, usernames, passwords, scripts, lo
by bpchaps 10y ago
Funny. I reported something similar to comcast after finding several of their engineers' home directories on github. Ssh keys, usernames, passwords, scripts, logs, and even code for a DVR machine (no idea). Thankfully comcast got the GH account deleted fairly immediately. It just took a public reddit post to get in contact with them after their posted routes didn't work.
The person who uploaded them there did government security before joining comcast, so it doesn't surprise me even for a second that this was a mistake. Though, the repo also had updates after his employment there ended.
- mynameislegion 10y agoIIRC there are services archiving all github repos. It would be better to just change all the codes that were leaked.
- daurnimator 10y agoeasier said than done when it's the keys for rolled out consumer premises equipment
- londons_explore 10y agoIf you ship hardware to a customer with software installed and don't have the ability to do automatic security updates on it in 2016, you need to rethink your strategy.
- bpchaps 10y agoThey said that they were going to work on swapping things out. When I talked to the PR rep about it last, he didn't have much of a clue whether they did or didn't swap anything out. They also mentioned a bug bounty, but that didn't go through either.
- reolt 10y agoA junior security operations employee at a company I worked at - who was fired for persistent incompetence - somehow obtained a fairly important position doing security for a government agency. That agency was (shockingly) later revealed to have very publicly embarrassing security issues. I imagine this sort of thing is pretty common. I feel like NSA might be able to make a stronger case for themselves if they were at least able to show they could do one of the most basic and fundamental things they're supposed to do be doing.