3 ms·
There's plenty of situations you don't hear about. A few years ago I f'ed up and accidentally pushed keys to a public repo, and by the next morning, we racked
by bdcravens 2y ago
There's plenty of situations you don't hear about.
A few years ago I f'ed up and accidentally pushed keys to a public repo, and by the next morning, we racked up $50k in AWS charges from crypto miners. We reached out, they gave us a security checklist that if we followed, they'd take off the charges. We did, and by Monday (my code push was Friday evening) the charges were taken off. No public shaming required.
- paulgb 2y agoI’m curious what sorts of things were on the checklist. I wonder if it’s something they will share proactively?
- bdcravens 2y agoIt's been a few years, so I'm going off of memory, but it was mostly best practices stuff (enabling Cloudtrail, rotating older keys, etc). Anything to ensure that once the attackers no longer had access, removing/monitoring anything that would have longer term implications.
- skeeter2020 2y agothis makes sense; plug the hole and stop taking on water before you ask for a free cleanup.
- perchlorate 2y agoYou likely already know that, but to anyone else interested: a good way to prevent these kinds of situations is to run 'nosey parker' on your git repo before pushing it to a remote. It will dig through your code and configs, looking at files and through all the git history, and highlight anything that looks like tokens, passwords, keys, etc. You can set it as a pre-commit hook to block the offending code from even being committed. https://github.com/praetorian-inc/noseyparker https://github.com/praetorian-inc/noseyparker