4 ms·

And a hundred times so for any public repos. There are bots feeding on the GitHub firehose, scavenging for accidentally committed credentials. A few years bac

by bostik 8y ago

And a hundred times so for any public repos. There are bots feeding on the GitHub firehose, scavenging for accidentally committed credentials. A few years back (2015 or so) the average time from push-to-repo to AWS account compromise was 6 minutes. Surely that time has only gone down, and the number of different credentials identified has gone up.

username223 8y ago
> the average time from push-to-repo to AWS account compromise was 6 minutes. Wow, I didn't realize it had become so efficient, but I shouldn't be surprised. I never really understood the value in hosting non-public software in the public, and if it's open source, it shouldn't be getting anywhere near secrets that can be used to extract money from its developers. I remember thinking, back when it became trendy for people to upload their personal dotfiles to Github, that it would be a source of endless suffering. Who knows what information you're leaking in your ".profile" or ".bashrc"? Is that risk justified by the dubious benefit of storing your dotfiles on the internet for everyone to see, forever?
- tjr225 8y ago
  I had accidentally pushed an AWS credential out a month or two ago- within about a minute and a half AWS had disabled the IAM user, and automatically emailed me(as well as my entire org- how embarrassing!)- when we were going through the access logs it looked like it had taken only a minute and a half longer for some other, presumably malicious, system to attempt to access my compromised user. Probably between 2 or 3 minutes total. I'm not a huge Amazon fan but props to AWS for saving my butt.
  - scarface74 8y ago
    Why have credentials anywhere outside of the .aws directory in your home directory? When developing locally all of the SDKs will read them from there and when deploying to AWS, the SDK will get them from the attached role.
    - tjr225 8y ago
      I understand what the best practices are, it was a total mistake- I never even intended to push what I did to github.
      - house9-2 7y ago
        `git diff` before making a commit `git log` and `git show` before pushing to a remote These 2 simple things have saved me on more than one occasion.
weinzierl 8y ago
> A few years back (2015 or so) the average time from push-to-repo to AWS account compromise was 6 minutes. Surely that time has only gone down, and the number of different credentials identified has gone up. I don't doubt that a second and I'd like to use that as a quote. I'd like to be prepared if someone doubts it, so: Do you have a primary source for this?
- bostik 8y ago
  I'll need to find the talk I lifted it from. Not easy... but looks like downthread a sibling comment gives a relatively decent update about the current speed of compromise.
  - bostik 8y ago
    Answering myself: I think it was a BSides London talk. (Quite likely from 2017.) After doing a search, I don't think it was recorded. Hence, I can't provide a primary source. Sorry.
- kelnage 8y ago
  This paper may be relevant to your interests: https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/ https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-chara...
- scraptor 8y ago
  Blog post summary: https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/ https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-chara... Source if blog is unavailable: https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd...
- frandroid 8y ago
  I thought that AWS nowadays is also feeding at the firehose and auto-disabling any of its keys it could find in a commit?

by bostik 8y ago

username223 8y ago

> the average time from push-to-repo to AWS account compromise was 6 minutes. Wow, I didn't realize it had become so efficient, but I shouldn't be surprised. I never really understood the value in hosting non-public software in the public, and if it's open source, it shouldn't be getting anywhere near secrets that can be used to extract money from its developers. I remember thinking, back when it became trendy for people to upload their personal dotfiles to Github, that it would be a source of endless suffering. Who knows what information you're leaking in your ".profile" or ".bashrc"? Is that risk justified by the dubious benefit of storing your dotfiles on the internet for everyone to see, forever?

tjr225 8y ago
I had accidentally pushed an AWS credential out a month or two ago- within about a minute and a half AWS had disabled the IAM user, and automatically emailed me(as well as my entire org- how embarrassing!)- when we were going through the access logs it looked like it had taken only a minute and a half longer for some other, presumably malicious, system to attempt to access my compromised user. Probably between 2 or 3 minutes total. I'm not a huge Amazon fan but props to AWS for saving my butt.
- scarface74 8y ago
  Why have credentials anywhere outside of the .aws directory in your home directory? When developing locally all of the SDKs will read them from there and when deploying to AWS, the SDK will get them from the attached role.
  - tjr225 8y ago
    I understand what the best practices are, it was a total mistake- I never even intended to push what I did to github.
    - house9-2 7y ago
      `git diff` before making a commit `git log` and `git show` before pushing to a remote These 2 simple things have saved me on more than one occasion.

weinzierl 8y ago

> A few years back (2015 or so) the average time from push-to-repo to AWS account compromise was 6 minutes. Surely that time has only gone down, and the number of different credentials identified has gone up. I don't doubt that a second and I'd like to use that as a quote. I'd like to be prepared if someone doubts it, so: Do you have a primary source for this?

bostik 8y ago
I'll need to find the talk I lifted it from. Not easy... but looks like downthread a sibling comment gives a relatively decent update about the current speed of compromise.
- bostik 8y ago
  Answering myself: I think it was a BSides London talk. (Quite likely from 2017.) After doing a search, I don't think it was recorded. Hence, I can't provide a primary source. Sorry.
kelnage 8y ago
This paper may be relevant to your interests: https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/ https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-chara...
scraptor 8y ago
Blog post summary: https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/ https://blog.acolyer.org/2019/04/08/how-bad-can-it-git-chara... Source if blog is unavailable: https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd...
frandroid 8y ago
I thought that AWS nowadays is also feeding at the firehose and auto-disabling any of its keys it could find in a commit?