21 ms·
>Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentia
by john_strinlai 5mo ago
>Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.
obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy.
but wait! it gets worse somehow
"“AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems"
while i understand and sympathize with the fact that CISA is kind of being gutted, a passwords.csv with weak passwords is inexcusable incompetence. not much budget is required for a password manager.
embarrassing all around.
- tantalor 5mo agoThe word you're looking for is "gross negligence"
- john_strinlai 5mo ago"crazy crazy" gets the same point across
- binkHN 5mo agoYeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.
- sandeepkd 5mo agoWhile I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than something thats shared across the company/group
- mikestew 5mo agoThe real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. This strikes me as so wrong, I wonder if I’m misreading your comment. For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords.
- realo 5mo agoYou are right... Most use Excel files ...
- sandeepkd 5mo agoLets take a concrete example, suppose you have AWS root account credentials. Are you going to assign them to one individual identity or as a company you would keep them accessible to a group of admins. Its going to be the second choice almost for every big company which makes them shared credentials. Coming to team password managers at high level, its a shared location guarded behind closed doors (probably encryption at transit and rest). They would be another set of software that every company specially small business or contractors may not be incentivized to pay for. Some one in their naivety considered Github as a safe enough place, assuming that the access is guarded which turned out to be wrong and exposed this thing. Lastly IT teams in large corporations being secure is a myth for most part. Your root keys for the most popular CA providers were shared in plain text emails not so long ago.
- antonvs 5mo agoThis organization is using AWS apparently. They would store the root account credentials in AWS Secret Manager. That costs $0.40 per month. People in the relevant admin group would have access to them. They would log in with their individual AWS credentials in order to access the root credentials if they need that. But, requiring AWS root credentials itself is an anti-pattern and implies an immature organization. That should not be needed for day-to-day operation. This is all just ignorance and incompetence, nothing more. > Lastly IT teams in large corporations being secure is a myth for most part. This is CISA. The Cybersecurity and Infrastructure Security Agency for the United States. Security is what they're supposed to specialize in. The only potential excuse here is that DOGE gutted them to a point that has completely compromised their capabilities. However, this situation is bad enough that it suggests that problems predated that incident.
- gleenn 5mo agoSometimes I feel like it's a cover for some other org actually just wanting to steal the data and this being the excuse.
- bix6 5mo agoYou mean like if our government was compromised at the highest levels and they wanted to undermine everything without the public realizing? Btw what happened to all the social security data that DOGE exfiltrated?
- red-iron-pine 5mo agothe fact we're asking about it means the public realized the problem is the public is dumb, at least when it comes to security, and couldn't tell you why password123 is bad
- bix6 5mo agoI think most people realize that leaving your passwords in public is dangerous.
- juvoly 5mo agoWhen empires collapse, it's usually not caused by a foreign power, but by negligence and corruption from within
- HoldOnAMinute 5mo agoDon't they call this "parallel construction" or some such ?
- nerdsniper 5mo agoI think willfully not reporting this is gross negligence, but also other things.
- deleted 5mo ago[deleted]
- totetsu 5mo agoOne the one hand the CISA is being gutted, and on the other hand there is an ever increase of rhetoric about cybersecurity, national interests, critical infrastructure..
- downrightmike 5mo agoThat's why we don't listen to rhetoric.
- SV_BubbleTime 5mo ago[flagged]
- ImPostingOnHN 5mo agoComplaining about gross negligence, after all the competence has been gutted out, strikes me as misdirected frustration.
- totetsu 5mo agoOh, thats interesting ,. this is one of those things where two people can hear opposite things from the exact same information.
- ImPostingOnHN 5mo agoWithout naming names, there's an old, old joke about a certain political party's philosophy: "Government is incompetent and ineffective! Elect us and we'll prove it!"
- array_key_first 5mo agoGutting doesn't magically solve incompetence. It's a anti-solultion that people peddle because it requires literally zero thought or nuance. If an organization has systemic incompetence and you gut them, then they're still incompetent but now they're also pressured and therefore more likely to make mistakes. So, you're just in a worse position.
- deleted 5mo ago[deleted]
- mystraline 5mo agoMost of the folks I know who were with CISA were purged with the January-March 2025 Doge campaign. 0 notice "we 20 year olds dont understand what you do so fired". A group was working on Diebold voting insecurity, and foreign implant hacking. Gone.
- mxuribe 5mo ago> ...A group was working on Diebold voting insecurity, and foreign implant hacking. Gone... The conspiracy theorist in me from years ago would have stated that maybe this action from DOGE was purposeful...but, nowadays, i see lots more incompetence that merely might present/display as conspiracy! lol :-D
- modriano 5mo agoSure, it could be incompetence. It could also be an intentional strategy to tie up CISA/DHS resources, poison or obstruct CISA/DHS investigations/operations, open up systems to sunlight and journalism, or cause general chaos. The not-responding-when-notified part makes me think it's not just incompetence.
- stackskipton 5mo ago>The not-responding-when-notified part makes me think it's not just incompetence. Strong disagree. The person in question probably thought it was a private repo on Github and had a massive deer in headlights reaction when they got contacted. Whoever this is, lost their job, possibly security clearance and more. This was 100% life altering "mistake"/gross incompetence decision they made.
- modriano 5mo agoMaybe. I didn't see enough in the article about the repo owner/committer to make any inference about their intentions and wouldn't jump to conclude it was incompetence or malice or crafty leaking. The only real signal I saw was that the repo didn't immediately turn private when the person was notified. For some people, yeah, this could be a career killer. For some other people, it might just precipitate a flight back to Moscow or Beijing or something.
- SoftTalker 5mo agothe CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories. That doesn't support the theory that it was a mistake. That was intentional action. Maybe he was being blackmailed, and was coerced to do it. Or maybe he was a foreign agent or sympathizer who had infiltrated the organization.
- stackskipton 5mo agoThere has been no indication if this was personally owned GitHub or Organizational owned GitHub. If it's personally owned, it still is one person doing massive dumb. Even if it's Organizational, it's very possible that person in question had rights to do this without oversight. I've been a government contractor before, it does not employ best and brightest, it employs the average and below generally.
- throwaway5752 5mo agoDOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional.
- parineum 5mo agoWhich DOGE employee put this file on GitHub?
- ceejayoz 5mo agoThey fired the people who might've prevented that. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-staffers-amid-ongoing-federal-cuts/ https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st... > Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.
- parineum 5mo agoNot posting secrets to public GitHub repos doesn't need red teaming.
- ceejayoz 5mo agoA red team might well notice that the build process doesn't check for accidentally committed secrets.
- gumby271 5mo agoAnd yet, here we are.
- jnovek 5mo agoStoring a bunch of passwords in a plain-text list that an individual can access violates zero-trust AND least-privilege which I think a red team might have some opinions on.
- jimt1234 5mo agoThe first "hack" I ever reported was when I found a plaintext passwords file on my high school computer network...in 1987. The more things change, the more they stay the same.
- JackGreyhat 5mo agoMachine Head - Struck A Nerve The more things change, the more they stay the same. Wise words, lovely song.
- g-technology 5mo agoMine too, but it was in the late 90’s and I found an open table in an access database that the school district used for grades and attendance. It listed plaintext usernames and passwords for every user in the system. I managed to use that to get to know the districts head of IT and get a summer job with them.
- delfinom 5mo agoDealing with IT departments run wild with cyber security monkeys that can only follow checklists with no independent thought. The spreadsheet of passwords is a tad more common than it should be because the password managers don't meet whatever arbitrary checklist of invented cyber security requirements they blindly follow. But Excel does. Lol
- uean 5mo agoNot defending this person, but it's obvious that this person used Github as a file-sync. Firefox-passwords.html and firefox-bookmarks.html are what you dump before migrating to a new computer and importing them there. An old school practice before FF sync was around. This is mentioned in the article but it stood out enough to call it here.