11 ms·

If this is a public repo then you are already hacked. There are multiple automated systems that scan public repos for credentials. 5 minutes later you are mini

If this is a public repo then you are already hacked. There are multiple automated systems that scan public repos for credentials. 5 minutes later you are mining bitcoins for them.

thieving_magpie 6y ago
Luckily I was in charge of setting up our remote repositories and made sure that by default they are all private repos, otherwise this would have happened without a doubt.
toomuchtodo 6y ago
Github monitors for public commits of service secrets. Not an excuse to commit secrets, but there is a bit of a safety net. > When you push to a public repository, GitHub scans the content of the commits for secrets. If you switch a private repository to public, GitHub scans the entire repository for secrets. > When secret scanning detects a set of credentials, we notify the service provider who issued the secret. The service provider validates the credential and then decides whether they should revoke the secret, issue a new secret, or reach out to you directly, which will depend on the associated risks to you or the service provider. https://help.github.com/en/github/administering-a-repository/about-secret-scanning https://help.github.com/en/github/administering-a-repository...
ganstyles 6y ago
In a boneheaded movei I accidentally committed my SendGrid creds to GitHub. Pretty quickly after, GitHub alerted me. However by then my SG account was sending thousands of automated spam messages. Those automated scammer systems are FAST. Not particularly germane to the discussion, but really disappointed in how SendGrid handled things. I notified them immediately, rotated all API tokens, and tey could not turn it off, so the spammer sent messages for days and eventually my SG account got suspended.
- jabart 6y ago
  My SG API keys, for an account that we terminated still send out emails if I happen to use an old config for a service. IP Rules are super helpful in this case, still need to rotate when exposed but can limit the exposure.
- bkandel 6y ago
  So this has happened at more than one company that I've been at, only difference is that these were AWS keys and used to mine bitcoin. AWS was actually pretty good about it, we rotated the keys as quickly as we could and they dropped all the charges.
  - meddlepal 6y ago
    I once worked for a co-founder who despite all the warnings I gave about not committing infra credentials to source control still went ahead and explicitly committed credentials to public source control because "the developer experience was better". The CEO was not pleased with the 30K (or maybe it was 60K) bill... and I just pointed at the CTO and was like "I fought this battle and was overruled"
    - mb7733 6y ago
      The most frustrating part of this is that the developer experience isn't better when you check credentials into source control. It seems convenient until the credentials change (which they ought to now and then). Then when you check out an old revision of the project, it is broken. You end up having to copy and paste the new creds back in time and it's finicky as hell.

If this is a public repo then you are already hacked. There are multiple automated systems that scan public repos for credentials. 5 minutes later you are mining bitcoins for them.

thieving_magpie 6y ago

Luckily I was in charge of setting up our remote repositories and made sure that by default they are all private repos, otherwise this would have happened without a doubt.

toomuchtodo 6y ago

Github monitors for public commits of service secrets. Not an excuse to commit secrets, but there is a bit of a safety net. > When you push to a public repository, GitHub scans the content of the commits for secrets. If you switch a private repository to public, GitHub scans the entire repository for secrets. > When secret scanning detects a set of credentials, we notify the service provider who issued the secret. The service provider validates the credential and then decides whether they should revoke the secret, issue a new secret, or reach out to you directly, which will depend on the associated risks to you or the service provider. https://help.github.com/en/github/administering-a-repository/about-secret-scanning https://help.github.com/en/github/administering-a-repository...

ganstyles 6y ago

In a boneheaded movei I accidentally committed my SendGrid creds to GitHub. Pretty quickly after, GitHub alerted me. However by then my SG account was sending thousands of automated spam messages. Those automated scammer systems are FAST. Not particularly germane to the discussion, but really disappointed in how SendGrid handled things. I notified them immediately, rotated all API tokens, and tey could not turn it off, so the spammer sent messages for days and eventually my SG account got suspended.

jabart 6y ago
My SG API keys, for an account that we terminated still send out emails if I happen to use an old config for a service. IP Rules are super helpful in this case, still need to rotate when exposed but can limit the exposure.
bkandel 6y ago
So this has happened at more than one company that I've been at, only difference is that these were AWS keys and used to mine bitcoin. AWS was actually pretty good about it, we rotated the keys as quickly as we could and they dropped all the charges.
- meddlepal 6y ago
  I once worked for a co-founder who despite all the warnings I gave about not committing infra credentials to source control still went ahead and explicitly committed credentials to public source control because "the developer experience was better". The CEO was not pleased with the 30K (or maybe it was 60K) bill... and I just pointed at the CTO and was like "I fought this battle and was overruled"
  - mb7733 6y ago
    The most frustrating part of this is that the developer experience isn't better when you check credentials into source control. It seems convenient until the credentials change (which they ought to now and then). Then when you check out an old revision of the project, it is broken. You end up having to copy and paste the new creds back in time and it's finicky as hell.