Below the Radar: Identifying Hidden Threats Within the Development Ecosystem
summary
Research finds Kubernetes secret objects (base64 encoded) leaking Docker registry credentials in public repos; Kubernetes Secret Docker config/json exposed yields many valid credentials and an artifactory token that accesses 95 million artifacts. Scan results show 994 Docker Hub accounts found, 64 active without 2FA. Analysis shows git clone --mirror finds ~18% more secrets than plain clone and cache/PR refs hide commits. Recommendations: use scanners that decode/entropy-check encoded secrets, rotate tokens, scan mirrored repos and cached commits, and treat any pushed secret as already exposed.
AI-written summary · about
chapters (8)
- 0:00Hidden threats in development
- 1:04Kubernetes secrets risks
- 5:43Shadow IT in development
- 8:58Phantom secrets concept
- 13:14Secrets in Git clones
- 20:42Git repo cache secrets
- 26:19Mitigation for exposed secrets
- 28:08Summary
related talks
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
32mContainers Don't Keep Secrets: Scanning Docker Hub for Leaked Credentials and Private Keys.
33mGaining initial access by exploiting leaked credentials
30mWhoops! I Accidentally Leaked My Credentials (again)
48mHow Source Code is Revealing our Secrets
32mContainer Security: Exploits, Vulnerabilities and Defense
11mLets secure our Kubernetes cluster
35mInsights into Unsecured Kubernetes in the Wild