Due to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
summary
They build and run an automated scanner called git-wild-hunt against GitHub, index matches into Splunk and output a results.json file; over eight months it finds leaked secrets including many passwords in URLs, GCP service accounts and AWS API keys, attributes leaks to about 276,000 companies, and measures an average exposure time of 52 days. The demo shows live API rate limits, 350 immediate matches, and a downward trend in leaks.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:56What are secrets
- 4:17Converged perimeter
- 6:51Credentials
- 9:16Risks
- 13:22Source
- 14:28NorthSouth
- 18:51Miter Attack
- 20:09Examples of GDS
- 23:16Exploiting Credentials
- 26:35Demo
- 26:45GetOneHunt
- 32:47Other Metrics
related talks
33mWhoops! I Accidentally Leaked My Cloud Keys
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
33mGaining initial access by exploiting leaked credentials
24mHow to Find if Your Developers are Leaking Secrets?
48mHow Source Code is Revealing our Secrets
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
30mWhoops! I Accidentally Leaked My Credentials (again)
33mCloud Hacking Scenarios