Whoops! I Accidentally Leaked My Credentials (again)
summary
New research presents a working pipeline that ingests artifacts from GitHub, npm, PyPI, Maven and Docker, unpacks releases and unpacks and scans each Docker image layer then matches and reports secrets to credential providers for remediation. The system has scanned 6.5 billion files, produced about 1.5 million flags and identified roughly 20,000 unique valid credentials, dominated by GCP API keys and service account keys. Findings show leaks in binaries, dist folders and deleted layers; recommended fixes are pre-publish scanning, least privilege, expiries and rapid rotation.
AI-written summary · about
chapters (9)
- 0:00Credential leaks problem
- 3:40Scanning open source artifacts
- 8:13Key findings from 6.5B files
- 14:18Common sources of leaks
- 17:09Where credentials hide
- 19:15Mitigation strategies
- 22:25Preventing leaks
- 24:31Future scanning plans
- 25:55Q&A
related talks
33mWhoops! I Accidentally Leaked My Cloud Keys
33mGaining initial access by exploiting leaked credentials
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
32mContainers Don't Keep Secrets: Scanning Docker Hub for Leaked Credentials and Private Keys.
30mBelow the Radar: Identifying Hidden Threats Within the Development Ecosystem
24mHow to Find if Your Developers are Leaking Secrets?
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible