AWS Urges Devs To Scrub Secret Keys From GitHub 109
An anonymous reader writes "GitHub contains thousands of 'secret keys', which are stored in plain text and can be used by miscreants to access AWS accounts and either run up huge bills or even delete/damage the users files. Amazon is urging users of the coding community site to clean up their act."
How effective is such an ... urging? (Score:5, Insightful)
If the problem is as widespread as TFA suggests, an article/post/urging by Amazon risks simply triggering the Streisand effect (I was tempted to do a search myself after reading the article).
Then again, I'm not sure what else they could have done.
Re: (Score:3, Informative)
Wouldn't the Streisand Effect in this context imply that more developers are going to be placing their AWS/API keys in plain view?
I think you're more referring to the effect of full disclosure, where by making it public you end up not just notifying the potential victims (if they're even awake) but also a not statistically insignificant amount of script kiddies - thus instead of having the effect of less exploited victims, you end up getting more. At least initially - in the long run it should be the other
Re: (Score:2)
> Wouldn't the Streisand Effect in this context imply that more developers are going to be placing their AWS/API keys in plain view?
> I think you're more referring to the effect of full disclosure, where by making it public you end up not just notifying the potential victims (if they're even awake) but also a not statistically insignificant amount of script kiddies [...]
Yes, that's what I meant.
Re:How effective is such an ... urging? (Score:5, Insightful)
Poor analogy, a better one would be if you saw someone jump into the ocean, near where sharks have been seen, should be blame you for then deliberately pouring blood near the swimmer in an effort to get him attacked, and yes I would blame you.
Or if someone was speeding, but a drunk ran a stop sign and hit the speeder, do you blame the drunk? Yes.
Or if you leave your front door unlocked and someone walks in and steals all your stuff do we blame the robber? Yes.
Just because someone does something silly does not mean they are not a victim when someone breaks the law targeting them.
Re: (Score:2)
And that has to do with the original post, which was specifically about assigning blame, how? Claiming someone is not a victim if they do x is just shifting the blame from the perpetrator of the attack to the victim.
Or was the first one just some sort of troll attempt so you could come back and sound smart, by moving the goal post?
I never stated that what the people are doing was ok, in fact I called it silly, but the thing to remember is that EVERYONE does "stupid shit like this" on their machines, even y
Re: (Score:1)
Or if someone was speeding, but a drunk ran a stop sign and hit the speeder, do you blame the drunk? Yes.
Agreed. AND you ticket the speeder.
Or if you leave your front door unlocked and someone walks in and steals all your stuff do we blame the robber? Yes.
Agreed. AND you raise the home-owner's insurance rates because they leave without locking their door and putting themselves at higher risk.
Just because someone does something silly does not mean they are not a victim when someone breaks the law targeting them.
I still agree. I think the debate here is more similar to noticing that there are unlocked doors and then posting an article announcing that people need to start locking them or risk burglary. If it's reasonable to notify each homeowner with an unlocked door that they and their family are at risk of burglary, then you do that. If t
Re: (Score:2)
Wouldn't the Streisand Effect in this context imply that more developers are going to be placing their AWS/API keys in plain view?
I think his meaning is that there would be more people searching/looking for the secret-key which is in plain text. If I remember correctly, Streisand Effect is the effect of trying to hide something from others, but instead it becomes more obvious to public because of certain disclosure. In this case, the AWS disclosed the information which is supposed to be hidden from public. Now it is obvious to others.
Re: (Score:1)
No, bad guys are already exploiting the AWS keys in github and there are already hundreds of documented cases. The advice from Amazon is sound and doesn't increase the risks for their users.
Re:How effective is such an ... urging? (Score:5, Insightful)
You cannot protect stupid people. You can only make sure that you told them they were being stupid in order to prevent that _you_ get blamed for their stupidity. That is what Amazon is doing here. The only other option I would see is forced closing of the affected accounts, but that would likely result in a PR nightmare.
Re: (Score:3)
The only other option I would see is forced closing of the affected accounts, but that would likely result in a PR nightmare.
They could just delete the authorized_keys file entries on their systems when the matching private key is found on in the wild - on github or elsewhere.
It's a heck of a slippery slope for Amazon, but we should recognize that ultimately they are Amazon's systems. Maybe create an environment where they will do this by default unless you explicitly op-out but if you op-out then there is
Re: (Score:2)
Amazon does not own the data. In Europe, for example, what you propose may well be criminal for them to do unless they can show a clear and present danger.
Re: (Score:2)
unless they can show a clear and present danger.
I won't pretend to understand the mind of European bureaucrats - do you think they would hold that having a criminal take over a computer system is not sufficient grounds for the owner of that system to take corrective action?
If that truly is the case, then Amazon should just nuke the vm in those jursidictions and tell the machine owners to take it up with their government or choose a hosting zone with different regulations.
Re: (Score:2)
You do not understand the problem at hand either: It is not a clear and present danger to Amazon if a key leaks. They may only interfere it it endangers the operation of their network and servers. While the US may be a complete nanny-state now (well, bad nanny that punishes and lest people starve but that does insist of control in everything), in Europe, you are expected to understand what you are doing to some degree and your service provider has no obligation to protect you against your own stupidity.
Re: (Score:2)
they could change the locks - and then tell every AWS client that a) the locks have changed so they need to regen a new key, b) change the T&C to say keys are private and are not to be publicly shared, if you do you lose that AWS account.
Then they can search github for keys and lock the relevant accounts, in the interest of security - as I guess the scammers will be happily helping themselves to those keys to create whatever nasties they can get away with on their new free hosting until they are detecte
Re: (Score:2)
Congratulations! Out of 16 posts so far, yours is the first one that's actually ON TOPIC.
Re: (Score:1)
Ban 'em (Score:5, Insightful)
Re: (Score:3)
In a time were you can sue the hell out of others because you were stupid, this is unfortunately not an option anymore.
Re: (Score:3)
It sounds like they're billing users with excessive usage when they get compromised. If that's the case, why should Amazon care that someone who had the correct authentication keys installed bitcoin miners? How are they to know that they weren't installed by the owner? As long as AWS as a service isn't impacted directly, I don't see that they'd care.
More than that, they never say they won't terminate instances for potential ToS violations (that's if poor credential practice is even a ToS violation). I j
Re: (Score:2)
If that's the case, why should Amazon care that someone who had the correct authentication keys installed bitcoin miners?
Two reasons:
1) they will probably wind up issuing refunds for some amount of it. Even if they don't refund then it will take up CSR time to deal with the upset user. Upset users may go elsewhere. It might also be cheaper to refund than to pay humans to deal with not refunding. Automated systems to prevent this may well be worth the investment.
2) bitcoin miners are probably the least
Re: (Score:2)
Spammers definitely will *not* get a whole Amazon netblock blacklisted. Amazon firewalls outgoing port 25 traffic. If you want to send email from AWS you need to bounce it via authenticated port 465 or 537 through a mail service on some other ISP.
Failtoban confirms (Score:2)
Run it, log it and you too will see a lot of aws
54.193.36.150
54.193.50.3
54.193.73.95
54.193.95.230
54.194.121.137
54.194.145.249
54.194.178.152
54.194.198.11
54.194.198.139
Wont bore you further, not sure informing abuse at amazon does anything though
Re: (Score:2)
Depends on how public the knowledge already is.This is the first time I've heard of it, but this kind of thing is done a lot (private stuff thrown on publicly available services that can be found via a Google search) so I'd guess this was already reasonably well known in the bad people circles. By shouting about it Amazon is ensuring that everyone knows without having to track down and inform people individually.
Re: (Score:2)
Readily public - even if not specific to AWS:
http://it.slashdot.org/story/1... [slashdot.org]
Opensource and web services keys (Score:1)
Many web services require developers to get keys for their applications. Open source applications cannot provide users with working apps without disclosing the keys.
Re: (Score:2)
Can't you just ship the software and let the user provide the key?
Re: (Score:2)
Getting the key requires registering an application and may be validated by the company providing the web service. How a normal non-technical user could do it? Even if it is was just creating an account it would be too much for a casual user of an application.
Re:Opensource and web services keys (Score:5, Insightful)
I'm sorry but you can't bundle a secret key in either source code or a binary, ship it to a user and somehow think that the user will be unable to extract it.
Re: (Score:2)
Of course.
Re: (Score:2)
I'm sorry but you can't bundle a secret key in either source code or a binary, ship it to a user and somehow think that the user will be unable to extract it.
The amount of effort can have major legal effects. For example, an easily circumventable copy protection measure turns copying from "copyright infringement" to "DMCA violation". Where I was raised, theft came in different categories for "taking away unprotected items", "taking by circumventing locks or other protection measures", "taking by using force or threat of force against persons", and "armed robbery". So the fact that a user extracted a key from a binary might have strong legal consequences, and tha
Re: (Score:2)
But why would a script kiddie on some other continent give a shit about any of that?
Re: (Score:2)
But why would a script kiddie on some other continent give a shit about any of that?
Because a country on some other continent has entered into a bilateral trade agreement with the United States.
Re: (Score:2)
Which, in combination with $1, will buy you a cup of coffee. I haven't noticed that Eastern European or Chinese spammers and attackers have been deterred one whit by those bilateral trade agreements.
Re:Opensource and web services keys (Score:4, Informative)
That's not a problem for the developer of the application, that's a problem for whomever is providing the hosted instance of their code. If a "normal non-technical user" is deploying the code, then they should equally be able to solve the problem of third party webservice keys etc where they are required.
Re: (Score:2)
Hosted? I was mainly referring to desktop applications.
Re: (Score:2)
Then your post makes even less sense.
The AWS keys referred to in the article are for the storage accounts et al, so theres no "registration" or "validation" of an application going on, you just sign up to AWS, create a bucket for S3 or whatever, and supply the connection credentials to the app.
And that is something that the end user most definitely should be doing.
Re: (Score:2)
What if I'm developing apps for kids?
COPPA (Score:2)
Re: (Score:2)
Yes you can. and real developers do just that.
Recurring developer fee (Score:2)
Re: (Score:2)
Not sure about the rest of AWS though.
There is no annual fee to have AWS keys. With AWS, you pay only for your usage.
Re: (Score:2)
No. They could just refuse service to complete morons. Other than that, there is nothing they can do.
Re: (Score:2)
Many web services require developers to get keys for their applications. Open source applications cannot provide users with working apps without disclosing the keys.
Depends on your definition of "working app". The source code can contain a random number, and it will work correctly in the sense that it sends the random number to the server to identify itself, and correctly determines that the server rejected it. Like a CD player application; you wouldn't expect the developer to supply CDs with it. Or an app processing credit card numbers for payment.
Re:Opensource and web services keys (Score:4, Insightful)
Your understanding of the open source license requirements is fairly broken - there is NOTHING in the GPL (any version) which requires the distributor of the code to provide access to third party services where they require the use of that third party service.
You are thinking of the anti-tivoism stuff in the GPLv3, which does not cover this.
Re: (Score:2)
I have a fair understanding of software licensing, thank you. I was not referring to the GPL in particular, nor any other license. It's not a licensing problem and I don't know why you misread my comment in this sense.
Re: (Score:2)
Closed source applications that access web services have to ship with a key as well. The only difference is how easy it is to access the key. It's the same issue as DVD players. Eventually someone cracked a key, because the DVD player has to be able to read the key.
Re: (Score:2)
Closed source applications that access web services have to ship with a key as well. The only difference is how easy it is to access the key. It's the same issue as DVD players. Eventually someone cracked a key, because the DVD player has to be able to read the key.
I think the problem is that with a closed source application, the API key can be somewhere in the source code, and I compile it, and then the API key is invisible except to a determined hacker. That's fine because I don't give you the source with the API key. With open source, I don't mind at all if you get the complete source code - with the exception of the single line with the API key. You would be free to get your own API key and put it into that single line of code and build your own version.
The API
Re: (Score:2)
If your FOSS application interacts with a web-based service that requires an API key, the correct way to implement it is to instead have it interact with your own servers, and in turn have your servers interact with the web service via the API key. You should of course then publish the source to the server-side part of your application as well, and advanced users can then (if they really want to) setup their own server, with their own API key for the web service; this also protects users from the possibilit
And? (Score:5, Insightful)
The summary tries to make it sound like it's Github's - or even Amazon's - fault.
If you're stupid enough to store credentials that allow access to pay-for goods in your name, and to then blindly upload them to a public service, I have little sympathy.
No more than people who upload their SSH keys, or hard-code their credentials into their code in the first place, or those who put the contents of their passwd/shadow/htpasswd file into a public arena. All of which we've had articles about people doing - and others finding via Google or just a quick inspection of certain projects. I'm sure there was even one with a Steam API key of some kind once.
Sure, it's easy to do if you're not paying attention - especially if you blindly upload a ton of hidden files (Why? Quite what hidden files do you need to upload to a public third-party version-management service? Yes, I've svn'd or bzr'd my /etc/ in the past for basic rollback functionality, but when you press commit to a public service, are you not checking WHAT files are going up and/or excluding hidden files by default anyway?)
Sorry, but for such projects Amazon shouldn't warn them, they should just block those credentials. It's a quick, easy lesson in how to manage your access to a third-party resource, and the hassle of having to redo your account verification should be enough of a kick up the bum to get you to never do it again.
And those people who were billed? Sorry, it's like asking the credit card company to refund you after you post your credit card number in a forum - sure, they might do it, but they are not obligated to as you breached the contract by failing to ensure the security of those details in the first place (proving it was your fault can actually make the credit card company not liable for it, even with "credit card protection" in law - it's just that proving it is usually more hassle than just paying it). The resources were consumed, by someone with your valid credentials. Your problem.
Re: (Score:3, Interesting)
Indeed. But stupid people (being stupid) will blame Amazon publicly anyways. Remember the random-number generator "bug" in Android recently that left some 30'000 Apps vulnerable? Turns out this was 100% developer error because they did not read the documentation and assumed the Sun/Oracle (but not 'Java') default behavior applied to Android as well. But who got the blame? Google. They did not even try to argue, although they were clearly wronged.
These days stupid people assume that they have a right to dema
Re: (Score:3)
If you're stupid enough to store credentials that allow access to pay-for goods in your name, and to then blindly upload them to a public service, I have little sympathy.
In fairness, credentials management is a bit of a tricky problem to solve. Most people screw it up.
Here's a real life example: I wrote an automated derivatives trading program that makes trades based on certain triggers. In order to access my brokerage account, the program needs access to my brokerage credentials. How does my program get the credentials? This is not a simple question. Options are:
Re: (Score:2)
If you're stupid enough to store credentials that allow access to pay-for goods in your name, and to then blindly upload them to a public service, I have little sympathy.
I have sympathy towards them. At least they did not act maliciously on other people but instead they mistakenly published their own private information. People make stupid mistakes...hey, I make stupid mistakes. Let's educate them to be smarter, instead of having them suffer of the outcomes of their stupidity. Let's make the world a more secure place for everyone. And that is precisely what Amazon is doing here.
Re: (Score:1)
hear hear *clapping*
we need something for this, kinda like the darwin awards but for this kinda fails :)
Supid is as stupid does... (Score:3)
these "developers" are making huge rookie mistakes. Honestly you are not a developer if you make that huge of a mistake. I can see hardcoding a key, but the version you put publicly is set to not function until someone changes it. cripes less than 3 lines of freaking code in nearly any language will make your release puke with "change the default key moron, did you not READ the README?"
Best solution, auto generate a key with the install script. Sadly most developers are too freaking lazy to write an install script.
Re: (Score:2)
With that kind of outlook, it's not surprising they are making rookie mistakes.
In related news... (Score:2)
In related news...
Google suggests you don't post your username & password to GitHub.
The locksmith's union suggests you don't tape your key to your front door.
The TSA suggests you don't write your combination on your luggage.
Re: (Score:2)
In related news...
Google suggests you don't post your username & password to GitHub.
The locksmith's union suggests you don't tape your key to your front door.
The TSA suggests you DO write your combination on your luggage.
FTFY. Or at least that you use the same key that everybody else does.
AWS needs to fix things up (Score:1)
People aren't putting their secret keys into code _just_ because they are dumb, it's also by far the simplest way to write code that uses amazon services from inside ec2. There are other (not particularly complicated and very secure) ways to do it, but amazon should probably look into making those so dead-simple no one would even think of using something else.
Re: (Score:2)
Sorry, but people doing that are worse than dumb. They do not care! Anything they get as result of their utter stupidity is well-deserved.
Re: (Score:2)
Re: (Score:2)
If you have to ask, then you are not capable to understand the answer. But you may want to visit a shrink sometime.
Re: (Score:2)
Re: (Score:2)
You still have no clue what this is about. Hint: Look up "evolution" and "negative feedback".
Re: (Score:2)
Re: (Score:2)
Seriously, it's as easy as S3Client s3 = new S3Client(); and the SDK does the rest. If devs are still hardcoding credentials, I have no sympathy.
Umm (Score:1)
> the users files
Um, that should be "the user's files".
users = more than one user
How the poster can have problems with the difference between possessive and plural and still be allowed to use a computer is beyond me. Aren't you supposed to learn fourth grade English before you get to college?
Re: (Score:2)
ESL (Score:2)
Aren't you supposed to learn fourth grade English before you get to college?
English is not necessarily required if you go to college somewhere other than the United States, Canada, Great Britain, Ireland, Australia, New Zealand, South Africa, or India.
Re: (Score:2)
If that is true, it's pretty pathetic.
How can people be allowed in if they don't show a basic competence with the very basics of the language they are supposed to converse in?
People in France speak French (Score:2)
English is not necessarily required if you go to college somewhere other than [Britain or one of its ex-colonies].
How can people be allowed in if they don't show a basic competence with the very basics of the language they are supposed to converse in?
In countries whose official language is not English, conversing in English is not necessarily required. For example, universities in France likely conduct classes in French.
Better way to handle this (Score:2)
Nice job obfuscating the key (Score:1)
When posting screenshots containing secret keys, just remove a large part of it. Don't use blur or swirl like filters, these can be reversed quite well.
The blurred key posted by itnews is pretty much reversible with the naked eye.
Re: (Score:2)
When posting screenshots containing secret keys, just remove a large part of it. Don't use blur or swirl like filters, these can be reversed quite well.
The blurred key posted by itnews is pretty much reversible with the naked eye.
According to the summary the blurred key, and others, are already available in plaintext on Github meaning countless people could have already captured them and possibly still can.
start telling the truth aws (Score:1)
Re: (Score:2)
I'm not quite sure what you're talking about. Auto-scaling groups are the only thing that can restart a terminated instance (actually, they start a *new* instance). If you somehow managed to create an auto-scaling group and don't know how to set its parameters (min/max/desired) down to zero, when it's right there on the GUI, I don't know what to tell you.
Re: (Score:1, Insightful)
Agreed. Also, The People should not have access to:
1. crypto
2. computers with unsigned boot chains.
3. unlicensed programming tools of any kind.
4. untrackable vehicles
5. untrackable currency
6. non networked home appliances
We're only about a decade or two away from this being 'normal'.
Re: (Score:2)
Obligatory RMS [gnu.org]
Re: (Score:2, Insightful)
The last school shooting could have been prevented if only crypto was banned!
Oh you mean the one that happened in a GUN FREE ZONE?
It's as though criminals willing to commit murder aren't afraid of jail and don't obey weapons restrictions huh. If only the law-abiding adults on campus had some method of fighting back...
Re: Everything else is simply too dangerous (Score:4, Funny)
If he shoots you on a daily basis, you may want to consider changing cubes after a few days. Maybe mention this behavior to management, too.
Re: (Score:1)