4 ms·
One the issue of uploaded credentials, is there a chance that a portion contain dummy placeholder values in config files, or are they hardcoded?
by krmboya 3y ago
One the issue of uploaded credentials, is there a chance that a portion contain dummy placeholder values in config files, or are they hardcoded?
- codetrotter 3y agoSome of them might even be canary credentials. For example, here is one service that is able to generate various canary tokens: https://www.canarytokens.org/generate https://www.canarytokens.org/generate
- jwilk 3y agoWhy would anyone upload canary credentials to PyPI?
- codetrotter 3y agoSecurity researchers wanting to investigate what kinds of credentials other people are looking for, for example. Or as another example, someone who wants to research how often people copy paste example config files without replacing things like credentials given in the example. Probably a bunch of other reasons too.
- nhggfu 3y agoi had never heard of this "smart stuff as a service" before. thanks @codetrotter
- orf 3y agoLots of dummy ones in tests for sure. I’m going to follow up with some deeper analysis on this topic in a few weeks, but you’d be surprised.
- chanux 3y agoThanks for the fantastic work! So you found 57 live AWS keys[1]. That's out of 1631 according to your stats (If I didn't misread something). I wonder how many of the top two in the list are live :D Google API Key 4,015 OpenAI API Key 3,531 [1] https://tomforb.es/i-scanned-every-package-on-pypi-and-found-57-live-aws-keys/ https://tomforb.es/i-scanned-every-package-on-pypi-and-found...
- orf 3y agoOh no, that’s the first incarnation of this project. It scans the code without committing it. The project that leverages GitHub secret scanning found a lot more.
- progmetaldev 3y agoI know for myself and my team, I often use placeholder values for config files, but they would often be tokenized, so easy to tell they were placeholders. For example "%%USERNAME%%" or "%%PASSWORD%%".