Gaining initial access by exploiting leaked credentials
summary
Research finds 10 million secrets on GitHub and about 5% of Docker Hub images containing plain-text credentials; attackers monitor the GitHub API events feed and Git history to harvest AWS keys, Google API tokens and Slack webhooks. Real incidents include the Codecov supply-chain compromise (malicious change in a public Docker image) and a mobile app leak exposing 10,000 check images on an S3 bucket. Tools demonstrated: GG Shield, Dive, Red X; mitigations: rotate keys, use a secrets manager, whitelist services and scan commits.
AI-written summary · about
chapters (18)
- 0:00Leaked credentials exploitation
- 1:03What are secrets and why they matter
- 3:10Scale of secret sprawl in apps
- 5:19Finding secrets on GitHub
- 9:32Abusing GitHub API for discovery
- 10:56Real-world credential leaks
- 13:01Why secrets end up in code
- 15:52Secrets in Docker images
- 17:17Codecov supply chain attack
- 19:45Secrets in mobile apps
- 22:32Bank app leak exposing checks
- 23:56Mobile app secrets study
- 25:00Live demo of exploitation
- 26:45Preventing hardcoded credentials
- 27:49Choosing a secrets manager
- 28:50Automated secrets detection
- 29:53Secret management best practices
- 30:35Q&A
related talks
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
48mHow Source Code is Revealing our Secrets
30mWhoops! I Accidentally Leaked My Credentials (again)
24mHow to Find if Your Developers are Leaking Secrets?
30mBelow the Radar: Identifying Hidden Threats Within the Development Ecosystem
33mWhoops! I Accidentally Leaked My Cloud Keys
53mAre your secrets secure? How mobile applications are leaking millions of credentials