5 ms·
Corporate Secrets Were Left Exposed. This Guy Found Them All
- itohihiyt 2y agoLight on detail. TL;DR a security researcher found lots of common security issues by using alternative data sources.
- Everdred2dx 2y agoI found the technique he used to find secrets using YARA rules to be extremely clever, at least.
- itohihiyt 2y agoNow that's interesting, I initially read this article using Firefox's reader mode. Turns out the article is a lot longer than presented in reader mode (8 of 21 paragraphs), hence my comment. The detail is after the part I was presented, had you not mentioned the technique used I wouldn't have known.
- probably_wrong 2y agoI understand how one would use YARA rules to identify that there's a file in VirusTotal containing secrets. What I don't get is whether there's a way for an actor to actually get the content of that file.
- mmooss 2y agoThe scale of incompetence in our industry should be embarassing. You can also see it in the public statements made by some SV 'leaders' - what other industry has prominent people making fools of themselves like that? Is it a surprise that their products are poorly made or often scams? When people tell you who they are, believe them! If you want to see something scary, look at the fake story Demirkapi managed to post, and note the domain name - actually nytimes.com! (IMPORTANT: The story is not real!) https://web.archive.org/web/20230330043732/https://intl.prd.nytimes.com/web/20230330043732/https://intl.prd.nytimes.com/2023/03/29/us-declares-war-against-russia-amid-escalating-tension.html https://web.archive.org/web/20230330043732/https://intl.prd.... Again, that's not real. But if the hacker tried, lots of people could react long before they realize it.
- rootsudo 2y agoIn other words: Opportunity.
- croemer 2y agoThe archive.org link does not yield a hit for me
- mook 2y agoThat didn't work for me either, but https://web.archive.org/web/20230330043732/https://intl.prd.nytimes.com/2023/03/29/us-declares-war-against-russia-amid-escalating-tension.html https://web.archive.org/web/20230330043732/https://intl.prd.... did. It looks like the link got doubled up.
- croemer 2y agoExcellent, that works!
- ben_bai 2y agoRecent research showed the increase in the number of programmers twofold every year all over the world. That means 75% of Programmers (SW Developers) have less then 2 years of experience! We are still a very inexperienced and unregulated industry.
- lifestyleguru 2y agoExperienced SW wants to make decisions, autonomy, and is more expensive. The world only wants to get the bloody software somehow working cheaply.
- creshal 2y agoMostly because we are an immensely ignorant industry jealously guarding what little scraps of knowledge we gleam. Theoretical computer science results get ignored for decades, until people like Carmack randomly sit down and read a book. (The rest of the world then gets to read about it years later in a biography, and it's still revolutionary since nobosy else sat down to read a book in the meantime.) A lot of institutions know how to write efficient, safe software, but at best will talk about it in a blog post, their experience will never filter down into classes to teach the next generation. And because that's not bad enough, we try to suffocate every possible problem with "more headcount", since that's easier than actually figuring out what your core problem is.
- ffjffsfr 2y agoHe used retrohunt service which is part of virustotal https://virustotal.readme.io/docs/searching https://virustotal.readme.io/docs/searching a service that allows developers to scan files for vulnerability. Apparently, virus total stores files and allows third parties to rescan these files later. Sounds like a vulnerability of this service and terrible practice. How can you expose your user files to any arbitrary access? Of course you should not put your secrets into file you upload to some virus scan, but how many users know that file they upload will be accessible publicly?
- throawayonthe 2y ago[dead]
- croes 2y agoYour link just says they store the scam result which can be accessed without submitting the file. >VirusTotal stores the analyses and report. This allows users to query for reports given an MD5, SHA1, SHA256 or URL and render them without having to resubmit the items (whether URLs or files) for scanning
- fire_lake 2y agohttps://archive.ph/OBGWm https://archive.ph/OBGWm
- rosendanew 2y ago[flagged]
- deleted 2y ago[deleted]
- Ukv 2y ago> Demirkapi turned to Amazon Web Services, but the company refused to provide him with access to existing private reporting tools. “We believe firmly that customer credentials, including security keys, belong solely to customers. AWS does not grant external users access to manage or revoke security keys as that would violate security policies and erode customer trust,” says Aisha Johnson, an AWS spokesperson AWS's response seems muddled. To make sure that "customer credentials [...] belong solely to customers" surely you would typically want an endpoint to revoke exposed secret keys?
- loa_in_ 2y agoExposed secret keys is not a technological problem, not really. It doesn't belong to the category of problems you solve with automated decision making. I leave it to the reader to imagine how automated decision making would play out here. But they should accept feedback about exposed secret keys through some way where a responsible person in company could act on it.
- Ukv 2y ago> I leave it to the reader to imagine how automated decision making would play out here Could you elaborate? Many other services have automated revocation, either through scanning for exposed keys or offering an endpoint to submit keys to, and as far as I can tell the way it has played out is in successful warning of and prevention of many leaks. I don't see how lack of it can be justified as a "security" measure.
- loa_in_ 2y agoIMO it's going to result in a potential DoS by submitting guesses en masse, denying whole revoking whole company's access until key renewal.
- Ukv 2y agoKeys should have sufficient bits of entropy to not be guessable. And if a malicious actor can guess a key, you should want it revoked as opposed to them doing more serious damage through other endpoints.