12 ms·
A mistakenly published password exposed Mercedes-Benz source code
- notso411 3y ago[dead]
- Shrezzing 3y ago> Shubham Mittal, co-founder and chief technology officer of RedHunt Labs, alerted TechCrunch to the exposure and asked for help in disclosing to the car maker. The London-based cybersecurity company said it discovered a Mercedes employee’s authentication token in a public GitHub repository during a routine internet scan in January. That's a strange way to disclose a security security issue.
- esskay 3y agoIndeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.
- _kbh_ 3y ago> Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find. Reporting via a third party isn't super unusual if you think that a organisation may be a bit legal threat happy from your report.
- waihtis 3y agoThis may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.
- hug 3y agoNo, his point remains: companies may act in bad faith, and publicly committing to act in good faith is absolutely no evidence they will not. I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.
- waihtis 3y ago> publishing a bug bounty program doesn’t mean you’re the good guys this is meaningless rabble. Yes you can get burned in all kinds of legitimate situations [1], but 99.xx% of bug bounty interactions do not result in any kind of legal action even if you wander a bit out of scope [1]: https://eu.desmoinesregister.com/story/news/crime-and-courts/2021/08/01/arrested-coalfire-security-testers-2019-file-dallas-county-iowa-courthouse-lawsuit/5431611001/ https://eu.desmoinesregister.com/story/news/crime-and-courts...
- mavhc 3y agoAssuming anyone is reading that email account
- johannes1234321 3y agoLawyers will. Then having journalists in the conversation helps, as they can produce bad press if the lawyers play games.
- wirrbel 3y agoIt’s pretty dangerous according to German law to disclose security issues.
- joshuaissac 3y agoFrom earlier this month: German Court Fines Security Researcher for Reporting a Company's Data Vulnerabilities https://news.ycombinator.com/item?id=39098969 https://news.ycombinator.com/item?id=39098969
- mass_and_energy 3y agoThis is why I need the CCC in my life
- sparrowInHand 3y agoBut they have no big influence, they just play the courtjester to a forever demented king.
- meinheld111 3y agoThou it would be worse without a jester
- riedel 3y agoAnd it is in this sense kind of a smart move if you do not want to pay for a lawyer and there is no bug bounty program with T&Cs: journalists can protect their sources. However, you then somehow need to make sure that they waive potential hacking charges. Funnily in the quoted case one of the reasons for the fines was damages related to involving the press.
- rurban 3y ago> journalists can protect their sources. But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.
- cqqxo4zV46cp 3y agoTechCrunch would be very far down my list of publishers were I wanting to responsibly publicly disclose something. Hard for me to take this particular outfit seriously after they decided to optimise for engagement by running to Entertainment Tonight.
- weego 3y agoThe'd be on my list if my goal was tie in someone who will give me easy, and very visible, publicity to the process.
- rvnx 3y ago"I contacted unrelated people and all the press to help them"
- xeornet 3y agoSounds like he was just trying to guarantee a mention (advertising and clout) in the subsequent TechCrunch article…
- waihtis 3y agoCall it what it is, a totally rat move placing Mercedes in risk for pure self-promotion purposes - instead of going via the vulnerability disclosure channel (first result on google when googling "mercedes security disclosure".) I hope nobody is stupid enough to ever engage with this firm after this publicity stunt.
- 0x_rs 3y agoThe only thing putting Mercedes at risk are previous sentences going heavy handed on ethical security researchers that bothered contacting german companies. You can find some examples online where just "poking" with leaked credentials not unlike OP was not looked favourably upon. https://www.theregister.com/2024/01/19/germany_fine_security/ https://www.theregister.com/2024/01/19/germany_fine_security... https://www.darkreading.com/vulnerabilities-threats/another-researcher-hit-with-threat-of-german-anti-hacking-law https://www.darkreading.com/vulnerabilities-threats/another-...
- waihtis 3y agothere's a world of difference in contacting a company via an ethical vulnerability disclosure program and doing so without one in place. it really shouldn't be that difficult to understand. Being "german" has nothing to do with it
- kavalg 3y agoI wonder if any private keys used for signing genuine MB parts have leaked as well. Auto makers seem obsessed with controlling the spare part market and leaking the keys used to authenticate spare parts would make it possible for other vendors to produce compatible parts in the future.
- rswail 3y ago> Auto makers seem obsessed with controlling the spare part market It is a major source of revenue and allows for markups to be optimized for brand. A lot of parts are shared across lines within a manufacturer and across manufacturers. MB wants their customers buying MB parts with an MB markup. Even if it's a Bosch part that is identical in a Ford.
- djaychela 3y agoIndeed. Ironically I had a porsche 928 which used an air actuator from Mercedes, and it was a fraction of the price from them. Parts guy at merc was a little sniffy, but it saved me £100!
- jacquesm 3y agoLots of German car components are generic Bosch, just with different markup depending on whether you're looking at Skoda, VW, AUDI, BMW, MB or Porsche in that order.
- bombcar 3y agoMercedes used to be insanely good at parts - I could order brand new stock parts for a 25 year old 240D with no issues and at quite reasonable prices. Those old cars were clearly designed by engineers who cared; the hood had simple latches on the hinges that when opened would let it open to vertical. https://www.classiccarstodayonline.com/2022/04/22/mercedes-123-article/mercedes-123-hood/ https://www.classiccarstodayonline.com/2022/04/22/mercedes-1...
- fransje26 3y ago
- deleted 3y ago[deleted]
- hoseja 3y agoAutomotive software should be mandated to be open-source.
- sauercrowd 3y ago? Why?
- INTPenis 3y agoI'm not the person you replied to but I agree, because it's related to public safety. Same with aviation software. Anything that deals with public safety should be audited by the public.
- thaumasiotes 3y agoMaybe we could start with this much less general principle: Whenever the output of software is offered as evidence against you in court, you should be entitled to the source code of the software.
- calgoo 3y agoThe post office workers in the UK who where f-ed over by the government because the software was reporting things incorrectly could really have used this as well. Should all our financial systems be open source too? Maybe it should be like Copyright or patents, you can keep things private for a while for an advantage, but then you would need to release all code as open source / public domain or similar? It should also be available before that to be reviewed by professionals following a formal process of some sort.
- adh636 3y ago> Should all our financial systems be open source too? Yes.
- jacquesm 3y agoThat's really a good thing you are on to there.
- cryptos 3y ago> The repositories include a large amount of intellectual property… connection strings, cloud access keys, blueprints, design documents, [single sign-on] passwords, API Keys [...] That doesn't really sound like security best-practices would be applied. Why don't they use a credential store?
- jamesrr39 3y agoJust guessing as an outsider, but... it's a big, conservative car company trying to do software development. Reasons could include: - Too much red tape/risk assessments/effort/time required to set up a credential store - Devs working there may not know/understand the importance of it, and may not be up-to-date with modern software development practices. - Assumption that Github repo will always be private, correctly configured, never leaked. - Assumption that employee computers with code checked out will always be full disk encrypted and source code never read by a malicious program/transmitted somewhere else. If you work in a company that makes software for a living, it's worth bearing in mind you are probably nearer the forefront of modern best practices and there are many companies in other industries that do some software as part of, but not the main part of the product, and these do not necessarily focus on software development and therefore may be "as hot" with best practices, to put it mildly.
- mass_and_energy 3y agoI mean, I think it's fair to say that given they're developing their "Drive Pilot" level 2 SAE software, at least some of this code involves life-or-death systems. For that reason alone I'd expect a higher level of security awareness, so seeing how unhygienic their repos are from a sec perspective is a bit unsettling.
- kdmccormick 3y agoAgreed it is unsettling. For what it's worth, there's some peace of mind in that this software is probably tested much more thoroughly than the average piece of Web software or whatever. Version control / security best practices / clean code may be too abstract for these old companies, but testing isn't. You'd hope.
- deleted 3y ago[deleted]
- jacquesm 3y agoSo, maybe someone can go and help fix their miserable mess? MB used to make awesome cars. Then they 'modernized' their interior and it became a UI mess and then they added more and more software and it became unreliable and sometimes downright dangerous. I have driven their cars on and off for decades but I'm really done with them. Highly unlikely I'll have another MB as my daily driver.
- jeffrallen 3y agoTry a Tesla, I hear their software is tip-top!
- sethammons 3y agoI haven't been in a tesla in a number of years. First and only ride. The map of cars around us having cars jumping to new locations and flipping between motorcycles and buses for the same neighboring vehicle did not inspire confidence. The car seemed confused on its surroundings. An exiting lane to our left on the freeway came to a stop during autopilot and thought our lane stopped so it slammed on the breaks nearly causing the car behind us to crash into us.
- jacquesm 3y agoWell, at least you were wide awake after that. TBF to Tesla, my Mercedes tried to kill me twice as well before I got rid of it so I'd call them about even in that respect.
- deleted 3y ago[deleted]
- miohtama 3y ago> The repositories include a large amount of intellectual property… connection strings, cloud access keys, blueprints, design documents, [single sign-on] passwords, API Keys, and other critical internal information.” Any senior developer or a security researcher knows this kind of secrets should not be part of the source code repository. Has Mercedes-Benz a rotten software development culture?
- Sheeny96 3y agoMany car companies are transitioning from a predominantly mechanical engineering space to a predominantly software engineering space, along with all the legacy mindset that comes with. It's par for the course when they can't understand that they're now a tech company and need to invest as such.
- OJFord 3y agoSenior developer or a security researcher?! This is like.. maybe you have to tell an intern kind of thing.
- AlwaysNewb23 3y agoWhat I want to know is how are they not using a secret manager (like Doppler or AWS Secrets Manager) at a company of this size? They could have avoided all of this. These types of leaks can cost companies everything (from their data to customer trust).
- miohtama 3y agoThe root cause: They are not using it because engineers who committed securities to a GitHub repository are not going to have any repercussions. Their salary does not depend on, like the salary of their bosses. So it does not cost anything on a personal level.
- AlwaysNewb23 3y agoYou are very correct but it’s also not on the dev product teams to decide the best practices for secrets at large companies. It’s the responsibility of the security and devops team to implement best practices.
- sparrowInHand 3y agoIt would be so trivial for github to inspect commits for tokken and reject them. Just one default github action.
- gempir 3y agoThat's already a feature. I would guess MB simply didn't enable it on their Enterprise instance, maybe because they push too many secrets. https://docs.github.com/en/code-security/secret-scanning/push-protection-for-repositories-and-organizations https://docs.github.com/en/code-security/secret-scanning/pus...
- sparrowInHand 3y agoThanks, i did not know..
- alkonaut 3y agoThe headline says "exposed source code". The article says it exposed keys, SSO passwords, and other things that sound much worse than exposing source code. Some tiny fraction of source code has value as intellectual property, but most of it is probably not valuable or sensitive. Passwords/Keys/PII/Documents on the other hand could be very bad if they got lost.
- AlwaysNewb23 3y ago[flagged]
- AlwaysNewb23 3y ago[flagged]
- wendyshu 3y ago> Your source code repo should never contain secrets like API keys. Why not?
- reaperman 3y ago1) Because exactly this happens 2) Because developers check out that source code and store it on their own laptops, which can sometimes get lost, stolen, or hacked. 3) Because with a proper secrets manager, each developer can get their own auth credentials for each service, increasing auditability.
- chandler767 3y agoAsk Mercedes-Benz. If somehow that repo gets exposed - so are all of your secrets. You just made a problem a lot worse and potentially opened up an avenue to expose more data.
- rcbdev 3y agoAre you by chance affiliated with the secrets manager solution you've attempted to promote a fair few times in this thread?
- AlwaysNewb23 3y agoYes- More people need to know secrets managers exist and the types of problems they solve. I'm passionate about helping people discover and understand what secrets managers do. Using any secrets manager would be better than none at all - it does not need to be our solution as there are plenty to consider.
- diarrhea 3y agoAre you associated with Doppler? You have been linking it multiple times in this thread, and this comment sounds like a sales pitch.
- wutwutwat 3y agoPasswords get leaked. Passwords get stolen. Passwords get guessed. This has always happened. This will always happen. If exposure of a string of characters is all that stops your source code from being accessible then you’re just not concerned about security whatsoever. Can’t complain about your house being robbed when you left the door open and the lights on.