Whoops! I Accidentally Leaked My Cloud Keys
summary
A pipeline that scans 6.5 billion files across GitHub, npm, PyPI, Maven, RubyGems and Docker Hub unpacks images layer-by-layer, matches regexes and reports leaks to credential providers; it finds about 20,000 unique valid leaked credentials and ~300,000 instances, with some keys appearing in over a thousand locations and GCP API keys leaking to a median of three places. The system reports to providers for remediation, plans pre-publish registry integration, and surfaces an open-source scanner library Vevelis for wider adoption.
AI-written summary · about
chapters (11)
- 0:00Leaked cloud credentials problem
- 1:01Why leaked credentials are critical
- 3:51Ghost’s credential scanning pipeline
- 7:39Key findings from 6.5B files
- 12:55Valid vs invalid leaked credentials
- 15:42Sources of leaked service account keys
- 19:57Unexpected credential leak places
- 22:45Impact on package popularity
- 24:09Mitigation strategies
- 28:21Preventing credential leaks
- 30:05Future of credential scanning
related talks
30mWhoops! I Accidentally Leaked My Credentials (again)
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
33mGaining initial access by exploiting leaked credentials
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
24mHow to Find if Your Developers are Leaking Secrets?
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
39mAre your secrets secure - How mobile apps are leaking millions of credentials
32mContainers Don't Keep Secrets: Scanning Docker Hub for Leaked Credentials and Private Keys.