10 ms·
I analyzed Stack Overflow for secrets
- soxocx 3y agoIt would be a nice feature if StackOverflow would blank out (####) patterns that potentially match passwords or at least offer this if their system detects a potential password in your post.
- choudharism 3y agohunter2
- dark_ph0enix 3y agoWhat did you write? All I see is ****
- marginalia_nu 3y agoI hope you handle this antique meme with care, as it's become quite fragile over the decades.
- viraptor 3y agoJ, K, APL and other coders would hate this.
- sshine 3y agoWhy? :)
- viraptor 3y agoBecause this is a valid line of J: s1a=: 0j2 %~ ^@j. - ^@-@j.
- SAI_Peregrinus 3y agoPerl would become just as hard to ask questions about.
- matan-h 3y agoI agree. I asked for a feature that warn users before they post secrets: https://meta.stackexchange.com/questions/394710/feature-request-a-simple-leak-detection-in-the-answer-tab https://meta.stackexchange.com/questions/394710/feature-requ...
- repelsteeltje 3y agoHmm. Fix the easy stuff, the low hanging fruit and you filter for the worse problems and get some false positives for free. When it comes to leaking secrets, don't trust tools. It's hard, it's human, it just happens. As for what StackOverflow should do — make it easy to fix leaks, which they do a good job at. Ie. users can edit or delete answers, comments after posting them. Even better if there's a means to create confidential back channels with poster or admin if you spot a potential leak.
- wryanzimmerman 3y agoYou can’t “fix” a leak, you have to revoke the involved secrets. Editing / deleting the answer is irrelevant.
- adevdevdev 3y agoFYI presumably the name of one of the developers gets leaked through the coffee lik.
- andrelaszlo 3y agoYou can choose to not make the donation public, but perhaps they didn't know there was going to be a blog post. I noticed as well and sent a coffee to kind of disguise them a bit :D
- buster 3y agoNice try, Mr. I-post-my-secrets-on-stackoverflow!
- andrelaszlo 3y agoHahaha, I believe in transparency so here's my mother's maiden name, the name of my first pet, and the street name of the house I grew up in.
- mattigames 3y agoI have often wonder how many passwords do security cameras capture when people type then on their phones or laptops, also stuff like one-time codes or credit card numbers and so on.
- albert_e 3y agonow feed that video en masse to GPT Vision
- qingdao99 3y agoas long as you'll pay for it
- albert_e 3y agoLooks like the tone of my post above was misread. I see photos being automatically OCRed by default now ... in Google Photos, in Microsoft SharePoint etc. I am just imagining that in future a GPT Vision processing of all videos ever captured might become similarly prevalent (and cheap). Which would open up a very easy attack vector / leakage of secrets ... like phone unlock pins and passwords. I am in the same boat as the comment I replied to -- concerned about new risks that new tech might bring to the table. My post was just "extrapolating" the risk to a larger scale -- not just one video clip being manually decoded, but all footage automatically spitting out secrets as simply as a Closed Caption / video transcript of today.
- ben_w 3y agoWhat frame rate do security cameras run at these days? Last time I saw genuine recorded footage was 1999, and that looked like 1 fps.
- selcuka 3y agoThat's about the speed average typist types. /s
- kafrofrite 3y agoReminded me of a funny story. Maybe a decade ago, when moving to the cloud was all the rage, my then employer decided to check whether the cloud was any good. Long story short, he asked me to conduct penetration tests against the major providers. In one of the providers I pivoted through some network and hit a webpage that looked like some sort of control plane panel (but required authentication so...). I decided to google part of the HTML and... A stack overflow thread pops up with the code and parts of the backend code/logic. So much win.
- williamdclt 3y ago> he asked me to conduct penetration tests against the major providers That sounds madly illegal?
- zakary 3y agoKnocking on someone’s front door and noticing it’s unlocked is perfectly legal. It’s actually walking in that’s illegal.
- toyg 3y agoAnd at least in England, trespassing is not even a criminal offense afaik, just a civil one - and the owner will have a hard time winning that case too, without very explicit signage. Unless one helps himself to the house contents, or does other Bad Things, walking through unlocked dwellings will get you at most a slap on the wrist.
- notRobot 3y agoThe pie chart has multiple segments with the same colors, how is one supposed to parse it? I do not understand how one can write an entire article about a set of data and then not present it in a way that is comprehensible? Edit: Just discovered that hovering over the segments of the chart will bring up a tooltip with the name of the segment if JS is enabled, but this is not obvious to readers and I still don't think this is a good way to present data.
- szszrk 3y agoA pie chart, while fun, is seldom a good way to present data at all.
- glenjamin 3y agoObligatory: "What do you mean I'm not supposed to use Pie Charts?!" https://www.geckoboard.com/blog/pie-charts/ https://www.geckoboard.com/blog/pie-charts/
- rob74 3y agoYeah, a bar chart would have probably been better in this case, then you would have been able to see the number of secrets at a glance by looking at the y axis.
- pimlottc 3y agoEven if they didn't repeat, that's just way too many colors for me to be able to tell which labels are for which segments. Anything more than a handful of colors should have arrows or labels next to the segments or something like that.
- KronisLV 3y agoGood job on letting the affected people know, at least the ones you could contact!
- rob74 3y agoThe question remains, how many of these "things that look like secrets" are actual secrets, and how many are 'password="[password]"' or 'password="12345678"' (where 12345678 is not the actual password)? Going by the only category they took a closer look at, there are not that many actually "actionable" secrets...
- hddqsb 3y agoYep. The relevant parts from the article: > ... I run a simple scan ... against all the 74 real looking GitHub user tokens ... and discovered that 6 of them are actually valid. > ... only 2 of them actually have bio and email, but one of them (a c/c++ developer) has a repo with 3.4k stars ... > I obviously couldn’t verify all the secrets. From most of them I’ll probably be banned, so I stooped here. As an alternative to manually testing the credentials (and risking bans), I wonder if any organisations would agree to test the credentials for you if you sent them a list of suspected leaks. If the organisation doesn't tell you which ones were valid (and takes responsibility for revoking/notifying), I don't see much room for abuse. Might be hard to convince the organisation of that though!
- matan-h 3y agoGitleaks regexes are fairly accurate. For example, the regex to find a GitHub PAT is "ghp_[0-9a-zA-Z]{36}" which mean it has a specific number (36+4) of characters from specific group (alphabet+number). And I try to filter out the obvious non-secrets (like 'abcd','xxxx' and '1234'). However, as I stated in the article, most of the data is not actionable: most people just revoke the token, use an old one, change some random letters, etc.
- jancizmar 3y agoWhat an easy way to get a free coffee! :D
- pveierland 3y agoIt could be nice if there was some clear general convention on a string format for secrets, e.g. `secret_<string>`, such that e.g. system copy paste facilities, email clients, chat clients etc. could provide an extra "Do you intend to share this secret?" step, ideally before even pasting it into a program, and especially before sending, to help prevent you from inadvertently exposing it.
- richbell 3y agohttps://datatracker.ietf.org/doc/html/rfc8959 https://datatracker.ietf.org/doc/html/rfc8959 Although I don't think the actual proposed syntax is good.
- pveierland 3y agoThanks, didn't know about that RFC! Will keep it in mind for such an occasion.
- InCityDreams 3y ago>"Do you intend to share this secret?" Please let Clippy just die...
- luhn 3y agoI've thought about even taking this further: Adding a domain to secret. e.g. secret:example.com:abc Then example.com could host a /.well-known/secrets.json which would include information on how to automatically report and/or revoke a leaked secret.
- onetimeuse92304 3y ago> Turns out, most of it is useless: For using most data, you need more information than just the api key. I think you mean low effort attacks. A determined attacker would attempt to gather more information, for example research the author of the post. Many of the authors give enough clues so that you can identify a person, even if comments are written using different handles. Also some of these secrets go in pairs with something else that is enough to get a successful auth. For example, AWS secret usually goes in pair with everything you need to connect.
- Thorrez 3y agoReminds me of this hilarious bug bounty: 1. Person reports some vuln in HackerOne itself to HackerOne 2. A HackerOne employee tries to reproduce it, and unknowlingly copies and pastes his/her cookies into the HackerOne report 3. The reporter takes those cookies, and logs in as the HackerOne employee 4. The reporter files a new vuln report "You are disclose for me you session. you are gevi me your session on last report. I am can use your session(sorry)" 5. $20,000 bounty https://hackerone.com/reports/745324 https://hackerone.com/reports/745324
- 7sidedmarble 3y agoThat seems to kind of go against the spirit of doing the work to find a vulnerability. It's basically social engineering. Do you get bug bounties for that?
- Thorrez 3y agoI wouldn't call it social engineering, because the reporter didn't intend to get the cookies while filing the first report. It's like the Github scanner that reports leaked tokens.
- asciii 3y agoWhat's crazy is that the reporter previously filed a bug report about hijacking sessions and then it comes full circle during a different report. That's karma
- starttoaster 3y agoI'd argue it's with the spirit, it's just that the vulnerability resides within your employees rather than your systems. Both are worth a call out and correcting. It's arguable how much either is worth, that being said.
- averageRoyalty 3y agoThe spirit of HackerOne is to encourage hackers to disclose rather than exploit for the reward of money. It makes a lot of sense that they's pay generously as a public statement to any hackers that find vulnerabilities on their systems.
- JoeMayoBot 3y ago> I sent both developers an email... This was a pretty nice thing to do. I see this on SO occasionally and edit the post to remove the secret. While the secret is already out there, it signals to the poster that they should revoke/regen the key and a bit of a reminder to help them avoid doing it again.
- zricethezav 3y ago> gitleaks : fatal error: runtime: out of memory Should be fixed now: https://github.com/gitleaks/gitleaks/pull/1292 https://github.com/gitleaks/gitleaks/pull/1292. Thanks for highlighting this simple change I've been putting off :)
- matan-h 3y agoThanks you for fixing it I`ve updated the blog. now my simple rust script is not that helpful :)
- bastawhiz 3y ago> For example, for stripe , you need the customer ID. For grafana, an instance url. For aws, a site url. Uh, no? For stripe, you just need the key (customer ID is the ID of a resource in the account). For AWS, you need the key id and secret, but these are nearly always colocated if you're actually dealing with keys.
- yencabulator 3y ago> ripgrep : freeze my system after few minutes. What OS is this person running where this is a possibility? Outside of bad regexps with e.g. large capture groups, a simple grep over a large bunch of data shouldn't cause any issues and should use a steady amount of memory.
- burntsushi 3y agoYeah I don't get it either. The only thing I can think of is that ripgrep saturated their I/O bandwidth and that led to other effects. Otherwise statements like "taking too much cpu" seem quite strange to me. If the OP could provide more precise reproduction steps then I'd be happy to look into it.