4 ms·

At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company say

At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company saying his token finding script went off. He probably wouldn't have noticed for a long while if that script wasn't running.

manarth 10y ago
Wouldn't the token-finding script be even more of a risk? If the token is XYZ and the script is searching https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&ref=searchresults https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&...: 1. It's sharing the token with GitHub. 2. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/less-trusted staff. 3. If the request is sent to a non-HTTPS endpoint, the query can be MITMd, revealing the token. I'd be very wary of setting up a token-finding script, it feels like it adds more risk than it saves.
- arjie 10y ago
  You just search that some token was uploaded by your people, not specifically yours.
- lutefisk 10y ago
  It was a pattern based script, all the tokens had the same length.
- obsurveyor 10y ago
  You can scrape the issues without exposing the token. You could probably do it by just subscribing to all of them and parsing emails. No one(especially in security) should be using a third party search to match sensitive data. It's like searching Google for your social security number.
- Keverw 10y ago
  Maybe they search the tokens public key and not the token itself. Then if the public key is found, then they download the repo and do scanning for the private key.
deathanatos 10y ago
A group at BigCorp Inc. was sharing a tool they'd written to ThirdParty Ltd. As part of this, they transferred documentation, including how to configure the tool. Including an example. With a real AWS key. For a dev too, so the key had no restrictions.

manarth 10y ago

Wouldn't the token-finding script be even more of a risk? If the token is XYZ and the script is searching https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&ref=searchresults https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&...: 1. It's sharing the token with GitHub. 2. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/less-trusted staff. 3. If the request is sent to a non-HTTPS endpoint, the query can be MITMd, revealing the token. I'd be very wary of setting up a token-finding script, it feels like it adds more risk than it saves.

arjie 10y ago
You just search that some token was uploaded by your people, not specifically yours.
lutefisk 10y ago
It was a pattern based script, all the tokens had the same length.
obsurveyor 10y ago
You can scrape the issues without exposing the token. You could probably do it by just subscribing to all of them and parsing emails. No one(especially in security) should be using a third party search to match sensitive data. It's like searching Google for your social security number.
Keverw 10y ago
Maybe they search the tokens public key and not the token itself. Then if the public key is found, then they download the repo and do scanning for the private key.

deathanatos 10y ago

A group at BigCorp Inc. was sharing a tool they'd written to ThirdParty Ltd. As part of this, they transferred documentation, including how to configure the tool. Including an example. With a real AWS key. For a dev too, so the key had no restrictions.